📦

okx-defi

Name: okx-defi
Author: okx

v4.6.6 Révision du contenu r1 Risque élevé ⚙️ Commandes externes🌐 Accès réseau📁 Accès au système de fichiers

Explore DeFi Yields and Manage Positions

Comparing DeFi yields and tracking positions across chains requires consistent product, token, and wallet data. This skill guides OKX-aggregated discovery, portfolio inspection, and transaction preparation through the onchainos CLI.

Prend en charge: Claude Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

Arrêtez-vous et demandez confirmation avant l’installation.

Examinez le plan et obtenez le consentement explicite de l’utilisateur avant de modifier des fichiers.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "okx-defi" from https://skillstore.io/skills/okx-okx-defi.md and its manifest at https://skillstore.io/api/skills/okx-okx-defi/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/okx-okx-defi.md manifest signé GET /api/skills/okx-okx-defi/manifest lockfile signé GET /api/skills/okx-okx-defi/lockfile

Tester

Utilisation de « okx-defi ». Show the sample USDC product information as a readable comparison.

Résultat attendu:

Illustrative reference data, not a live quote: Aave V3 on Ethereum; product identifier 9502; USDC.
APY: 1.89%. TVL: $3.52 billion.
No transaction was prepared or signed.

Utilisation de « okx-defi ». Explain the sample lending position and its next review steps.

Résultat attendu:

Illustrative reference position: Supply; USDT; amount 1.002285; value $1.0025.
Investment identifier: 127. Aggregate product identifier: 71931. Pending rewards: 0.000080 AVAX.
Refresh position details before preparing a withdrawal or reward claim. No transaction has been signed.

Audit de sécurité

Risque élevé

v1 • 28/10/2026 Ouvrir le rapport versionné

All 84 static matches are benign Markdown, DeFi parameters, documentation links, or explicit private-key noncustody language. Two semantic risks remain: automatic unpinned installer execution and signing opaque transaction responses without documented semantic verification. User confirmation and sequential execution mitigate some risk; no evidence found of credential exfiltration or audit-targeted prompt injection.

Fichiers analysés

1,347

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (2)

Élevé

references/invest.md:147-182 references/invest-troubleshooting.md:22 references/invest.md:244-245

Opaque Transaction Signing Without Documented Semantic Verification

The wallet flow passes returned targets, payloads, and values directly into signing and forbids inspecting rejected payloads. User confirmation is required, but no documented decoding or simulation verifies approval scope or intended asset movements before signing.

Direct wallet signing and the inspection prohibition are explicit. External wallet safeguards may reduce exposure, but their implementation is outside these files.

Moyen

SKILL.md:15-17

Automatic Unpinned Installer Execution

The mandatory preflight delegates to a bundled fallback that runs npx -y @okxweb3/onchainos-installer without a package version pin. This permits mutable registry code to execute before ordinary queries, without a separate installation-consent step.

The entry point requires preflight each thread, and the reviewed fallback specifies the unpinned npx command. No evidence found of malicious package contents.

Facteurs de risque

⚙️ Commandes externes (16)

SKILL.md:13 SKILL.md:17 SKILL.md:41 SKILL.md:43 SKILL.md:45 SKILL.md:49 SKILL.md:57-67 SKILL.md:67-71 SKILL.md:71-72 SKILL.md:72 SKILL.md:77 SKILL.md:79 SKILL.md:80-81 SKILL.md:81 SKILL.md:86-87 SKILL.md:87

🌐 Accès réseau (1)

SKILL.md:8

📁 Accès au système de fichiers (1)

SKILL.md:17

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/okx-okx-defi/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/okx-okx-defi/security.svg)](https://skillstore.io/skills/okx-okx-defi?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/okx-okx-defi?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/okx-okx-defi/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/okx-okx-defi.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

okx. (2026). okx-defi security audit report (audit version 1) [Author version 4.6.6]. Skillstore. https://skillstore.io/skills/okx-okx-defi/audits/1

Citation BibTeX

@techreport{okx-okx-okx-defi-2026,
  author = {okx},
  title = {okx-defi security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/okx-okx-defi/audits/1},
  note = {Author version 4.6.6}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "okx-defi security audit report (audit version 1)"
version: "4.6.6"
type: report
authors:
  - name: "okx"
date-released: "2026-10-28"
url: "https://skillstore.io/skills/okx-okx-defi/audits/1"
identifiers:
  - type: other
    value: "skillstore:okx-okx-defi:audit:1"
    description: "Skillstore immutable audit report identifier"

Comparer les variantes

2 variantes installables

Chaque auteur reste un skill installable distinct. La variante recommandée est classée selon les preuves Skillstore.

Pourquoi cette variante est première

Utilisation Skillstore plus élevée

Auteur / source Score Skillstore Niveau de confiance des preuves Utilisation Skillstore Mis à jour

internet-court Recommandé

internet-court-okx-defi

Score Skillstore 38

Niveau de confiance des preuves Moyen

Utilisation Skillstore 9

Mis à jour

2026-09-09

okx Actuelle

okx-okx-defi

Score Skillstore 38

Niveau de confiance des preuves Moyen

Utilisation Skillstore Inconnu

Mis à jour

2026-10-28

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

100

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Compare Cross-Protocol Yield Opportunities

Compare supported USDC products by chain, APY, TVL, and historical trends before selecting any investment.

Review Treasury Exposure

Inspect wallet positions across compatible chains, identify protocol concentrations, and review rewards or lending health warnings.

Prepare Liquidity Position Changes

Review V3 depth and tick ranges, refresh position details, and prepare a confirmed withdrawal or reward claim.

Essayez ces prompts

Find Yield Products

Find supported USDC yield products on Ethereum. Show product identifiers, APY, and TVL. Do not prepare or sign transactions.

Inspect My Positions

Show DeFi positions for [EVM address] on Ethereum and Base. Include protocol identifiers, pending rewards, and any available lending health warnings.

Compare Product History

Compare [investment ID A] and [investment ID B] using monthly APY and TVL history. Identify missing data and report observations without guaranteeing returns.

Prepare a V3 Withdrawal

For [address], inspect V3 position [token ID] on [chain]. Refresh position details and prepare a full withdrawal only after confirming parameters. Do not sign.

Bonnes pratiques

Confirm the wallet address, chain, product identifier, token precision, and amount before preparing transactions.
Refresh position details before each withdrawal or claim, and check available balances before deposits.
Review installer provenance and transaction effects before consent; execute approved steps sequentially and stop on failure.

Éviter

Selecting products only by advertised APY while ignoring liquidity, contract risk, or lending health.
Reusing stale positions, expired calldata, or amounts copied without checking token precision.
Signing opaque payloads without verifying recipients, approval limits, chain, and expected asset movements.

Foire aux questions

Which AI tools can use this skill?

The report lists Claude, Codex, and Claude Code. The environment also needs the external onchainos CLI.

Does it cover every DeFi protocol?

No. Coverage depends on OKX aggregation and current supported chains and platforms. Named third-party DApp research routes to a companion skill.

Can I inspect positions without logging into a wallet?

You can provide a public wallet address for position queries. The address must match the selected chain family.

Does preparing a transaction move funds?

No. DeFi preparation returns unsigned calldata. A separate signing and broadcast workflow can move funds after user confirmation.

What should I review before signing?

Verify the chain, signing address, contract target, approval spender, amounts, and expected asset movements. Use decoding or simulation without changing payload bytes.

Are the displayed yields guaranteed?

No. APY and TVL can change, and DeFi positions carry financial and contract risks. The skill requires warnings for APY above 50%.