📦
監査履歴
okx-agent-payments-protocol - 1 監査
監査バージョン 1 最新
2026年8月20日 08:36
Most static alerts are Markdown syntax, fixed documentation links, or protocol literals rather than executable threats. Confirmed risks include local private-key access and unattended installer execution. Critical semantic review found an A2A payment path that signs seller-controlled terms without buyer confirmation.
10
スキャンされたファイル
1,437
解析済み行数
17
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (7)
重大
A2A Payment Signs Without Buyer Confirmation
The buyer path fetches seller-controlled terms and signs them immediately without previewing amount, token, or recipient for confirmation.
The reference explicitly states that there is no preview or yes-no gate and that the server challenge is signed as-is.
高
Environment file access
Reads `EVM_PRIVATE_KEY` (env var or `~/.onchainos/.env`), derives the payer, generates the nonce, co
The fallback reads EVM_PRIVATE_KEY from the environment or a hidden file and uses it for local transaction signing.
高
Crypto seed/private key mention
- **Not logged in (`accepts`-based path)** → ask the user to choose between (1) wallet login (TEE si
The workflow offers local private-key signing after login failure, exposing a high-value credential to a host process and local configuration.
高
Dynamic Preflight Can Install and Update Executables
Preflight updates the binary and skill checkout, obeys dynamic action text, and runs a remote README installer without explicit approval.
The documented workflow requires automatic updates and installation, while instructing the agent to do exactly what data.action says.
高
Arbitrary Endpoint Probing Enables SSRF
The quote workflow probes a supplied URL without requiring HTTPS or rejecting loopback, private, link-local, or metadata destinations.
The skill passes a user-provided URL to a network-probing command and documents no destination validation.
高
Seller Price Changes Can Trigger New Voucher Signatures
A seller may change the unit price between requests, and the workflow signs a higher cumulative voucher without a new price confirmation.
The current seller challenge is authoritative, and the sign branch raises the cumulative authorization without a user gate.
高
User Values Enter Shell Commands Without Quoting
User-controlled payment-link fields are inserted into a shell command as placeholders without a required structured invocation or escaping policy.
The skill explicitly says to shell out and includes user-controlled description, realm, and recipient values in the command template.
機能レビュー項目 (5)
これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。
高
PowerShell invocation
- **The `onchainos preflight` command above errored with "command not found"** (onchainos not instal
The fallback executes an OS-specific installer from a remote README without separate approval, creating supply-chain and command-execution risk.
高
Hidden file in home directory
Reads `EVM_PRIVATE_KEY` (env var or `~/.onchainos/.env`), derives the payer, generates the nonce, co
The fallback reads EVM_PRIVATE_KEY from the environment or a hidden file and uses it for local transaction signing.
高
Hidden file access
Reads `EVM_PRIVATE_KEY` (env var or `~/.onchainos/.env`), derives the payer, generates the nonce, co
The fallback reads EVM_PRIVATE_KEY from the environment or a hidden file and uses it for local transaction signing.
高
Generic API/secret keys
Reads `EVM_PRIVATE_KEY` (env var or `~/.onchainos/.env`), derives the payer, generates the nonce, co
The fallback reads EVM_PRIVATE_KEY from the environment or a hidden file and uses it for local transaction signing.
高
Generic API/secret keys
- Local-key fallback signs entirely on the host — treat `EVM_PRIVATE_KEY` as a credential (`chmod 60
This path relies on a host-resident EVM_PRIVATE_KEY for local signing; restrictive permissions do not remove credential exposure risk.
リスク要因
⚙️ 外部コマンド (50)
_shared/preflight.md:16 SKILL.md:3 SKILL.md:17 SKILL.md:19 SKILL.md:23 SKILL.md:27 SKILL.md:29 SKILL.md:33 SKILL.md:42 SKILL.md:43 SKILL.md:54 SKILL.md:55 SKILL.md:56 SKILL.md:57 SKILL.md:60 SKILL.md:64 SKILL.md:72 SKILL.md:73 SKILL.md:74 SKILL.md:75 SKILL.md:76 SKILL.md:77 SKILL.md:78 SKILL.md:79 SKILL.md:80 SKILL.md:82 SKILL.md:84 SKILL.md:92 SKILL.md:93 SKILL.md:98 SKILL.md:102 SKILL.md:104 SKILL.md:106 SKILL.md:108 SKILL.md:109 SKILL.md:112 SKILL.md:113 SKILL.md:115 SKILL.md:116 SKILL.md:117 SKILL.md:118 SKILL.md:119 SKILL.md:120 SKILL.md:121 SKILL.md:122 SKILL.md:125 SKILL.md:126 SKILL.md:127 SKILL.md:128 SKILL.md:129
📁 ファイルシステムへのアクセス (12)
references/a2a_charge.md:8 references/a2a_charge.md:134 references/accepts-schemes.md:15 references/accepts-schemes.md:57 references/accepts-schemes.md:57 references/charge.md:7 references/charge.md:74 references/session.md:9 references/session.md:76 references/session.md:327 references/subscription.md:3 SKILL.md:64
⚡ スクリプトを含む (1)
🌐 ネットワークアクセス (2)
監査者: codex