스킬 okx-guide

📦

okx-guide

Name: okx-guide
Author: okx

v4.4.10 콘텐츠 리비전 r1 높은 위험 ⚙️ 외부 명령어📁 파일 시스템 접근🌐 네트워크 접근

Explore Onchain OS and OKX.AI

New users need clear paths through Onchain OS, OKX.AI roles, and support. This skill classifies requests and routes users into focused guided flows.

지원: Claude Codex Code(CC)

⚠️ 38 나쁨

Maintain this Skill? Claim it ⚠️ 38 나쁨

설치 전에 중지하고 확인을 요청하세요.

계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "okx-guide" from https://skillstore.io/skills/okx-okx-guide.md and its manifest at https://skillstore.io/api/skills/okx-okx-guide/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/okx-okx-guide.md 서명된 manifest GET /api/skills/okx-okx-guide/manifest 서명된 lockfile GET /api/skills/okx-okx-guide/lockfile

테스트해 보기

"okx-guide" 사용 중입니다. What can Onchain OS help me do?

예상 결과:

A localized welcome view explains wallet, trading, market, and payment workflows, then presents the available numbered choices.

"okx-guide" 사용 중입니다. What is the difference between an ASP and an Evaluator?

예상 결과:

An ASP offers agent services in the marketplace. An Evaluator reviews disputes and requires the platform-defined staking process.

"okx-guide" 사용 중입니다. I need to report a problem.

예상 결과:

The response directs the user to the OKX.AI Help Center and lists the steps for starting a support chat.

보안 감사

높은 위험

v1 • 2026. 8. 20. 버전별 보고서 열기

Most static findings are false positives caused by Markdown code spans, fixed relative links, and displayed URLs. Confirmed risks include automatic execution of mutable installation directives and loading hidden home-directory workflows, while semantic review also found unsupported earnings claims.

스캔된 파일

694

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (2)

높음

_shared/preflight.md:7-16

Mutable Preflight Directives Can Trigger Commands

The preflight flow says to do exactly what a returned action says, can force an upgrade, and fetches installation commands from a mutable README. A compromised CLI response or upstream document could cause unauthorized command execution.

The file explicitly mandates execution of returned actions and remote installation guidance without an allowlist, pinned artifact, or confirmation step.

중간

references/intro.md:19-38

Unsupported Financial Outcome Claims

The role-selection copy promotes million-per-year outcomes, round-the-clock earnings, and steadier income while encouraging paid services and OKB staking. These claims can unduly influence financial decisions.

The cited user-facing template contains direct earnings claims and a staking prompt without substantiation or a nearby risk qualification.

기능 검토 항목 (12)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

높음

_shared/preflight.md:16

PowerShell invocation

- **The `onchainos preflight` command above errored with "command not found"** (onchainos not instal

The fallback directs the agent to fetch current installation instructions and run the matching shell or PowerShell command. This executes mutable remote guidance without showing a pinned command or requiring user approval.

높음

references/how-to-play.md:54

Hidden file in home directory

- If the user came from picking the **Daily brief** option (option `4` in Variant A / option `3` in

The flow automatically loads and follows a mutable Markdown workflow under the user home directory. Unverified content in that file can introduce commands or instructions outside the audited skill.

높음

references/how-to-play.md:55

Hidden file in home directory

- If the user came from picking any other **workflow pick** while logged out: automatically load the

The instruction loads a variable workflow file from the hidden Onchain OS directory and follows it automatically. This crosses the audited package boundary without an integrity check.

높음

references/welcome.md:165

Hidden file in home directory

The menu routes directly to a mutable workflow in the hidden Onchain OS home directory. Following unaudited local Markdown can introduce unsafe instructions.

높음

references/welcome.md:166

Hidden file in home directory

This second menu variant uses the same hidden home-directory workflow handoff. The file is outside the audited package and lacks integrity validation.

높음

references/welcome.md:189

Hidden file in home directory

- **Logged-in user**: load `~/.onchainos/workflows/daily-brief.md` directly and follow it.

The instruction explicitly loads and follows the hidden daily-brief workflow for logged-in users. That is an intentional trust boundary crossing.

높음

SKILL.md:17

Path traversal sequence

**MUST**: Run the shared preflight **only for the onboarding flow** (§1 → `references/how-to-play.md

The onboarding flow actively reads a preflight file outside this skill directory and follows its instructions. Although the path is fixed, the external file can change independently and alter privileged setup behavior.

중간

references/how-to-play.md:54

Hidden file access

- If the user came from picking the **Daily brief** option (option `4` in Variant A / option `3` in

The line explicitly reads and follows a hidden home-directory workflow. The access is intentional and can expose the agent to mutable local instructions.

중간

references/how-to-play.md:55

Hidden file access

- If the user came from picking any other **workflow pick** while logged out: automatically load the

The wildcard workflow handoff intentionally accesses hidden local files and executes their guidance. No canonical-path or integrity validation is specified.

중간

references/welcome.md:165

Hidden file access

The route accesses a hidden local workflow without user confirmation or integrity verification. Its contents can change independently of this audit.

중간

references/welcome.md:166

Hidden file access

The alternate menu route accesses the same unaudited hidden workflow. This is real filesystem behavior rather than displayed example text.

중간

references/welcome.md:189

Hidden file access

- **Logged-in user**: load `~/.onchainos/workflows/daily-brief.md` directly and follow it.

The logged-in branch directs the agent to read and follow a hidden local Markdown file. No content validation or trust restriction is stated.

위험 요인

⚙️ 외부 명령어 (7)

_shared/preflight.md:16 SKILL.md:17 SKILL.md:19 SKILL.md:20 SKILL.md:28 SKILL.md:29 SKILL.md:30

📁 파일 시스템 접근 (19)

references/ai-guide.md:47 references/how-to-play.md:54 references/how-to-play.md:55 references/how-to-play.md:54 references/how-to-play.md:55 references/registered-home.md:12 references/registered-home.md:49 references/registered-home.md:52 references/unregistered-role-selection.md:19 references/unregistered-role-selection.md:20 references/unregistered-role-selection.md:21 references/unregistered-role-selection.md:26 references/welcome.md:165 references/welcome.md:166 references/welcome.md:189 references/welcome.md:165 references/welcome.md:166 references/welcome.md:189 SKILL.md:17

🌐 네트워크 접근 (3)

references/ai-support.md:16 references/ai-support.md:22 SKILL.md:8

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/okx-okx-guide/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/okx-okx-guide/security.svg)](https://skillstore.io/skills/okx-okx-guide?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/okx-okx-guide?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/okx-okx-guide/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/okx-okx-guide.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

okx. (2026). okx-guide security audit report (audit version 1) [Author version 4.4.10]. Skillstore. https://skillstore.io/skills/okx-okx-guide/audits/1

BibTeX 인용

@techreport{okx-okx-okx-guide-2026,
  author = {okx},
  title = {okx-guide security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/okx-okx-guide/audits/1},
  note = {Author version 4.4.10}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "okx-guide security audit report (audit version 1)"
version: "4.4.10"
type: report
authors:
  - name: "okx"
date-released: "2026-08-20"
url: "https://skillstore.io/skills/okx-okx-guide/audits/1"
identifiers:
  - type: other
    value: "skillstore:okx-okx-guide:audit:1"
    description: "Skillstore immutable audit report identifier"

변형 비교

설치 가능한 변형 2개

각 작성자의 스킬은 별도의 설치 항목으로 유지됩니다. 추천 변형은 Skillstore 근거로 순위가 정해집니다.

이 변형이 1위인 이유

Skillstore 사용량이 더 높음

작성자 / 소스 Skillstore 점수 증거 신뢰도 Skillstore 사용량 업데이트됨

internet-court 권장

internet-court-okx-guide

Skillstore 점수 38

증거 신뢰도 중간

Skillstore 사용량 11

업데이트됨

2026-09-09

okx 현재

okx-okx-guide

Skillstore 점수 38

증거 신뢰도 중간

Skillstore 사용량 7

업데이트됨

2026-09-09

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

100

유지보수성

콘텐츠

커뮤니티

100

사양 준수

만들 수 있는 것

Start with Onchain OS

Present the correct welcome view and route a first-time user toward a supported workflow.

Choose an OKX.AI Role

Explain User, ASP, and Evaluator roles before routing the selected registration flow.

Review Existing Agent Activity

Display registered identities and retrieve open tasks for a selected authenticated agent.

이 프롬프트를 사용해 보세요

Get Started

Show me how to start using Onchain OS.

Understand OKX.AI Roles

Explain the User, ASP, and Evaluator roles in OKX.AI without starting registration.

Open My Agent Home

Show my registered OKX.AI identities and explain each status. Do not display signing addresses.

Review Agent Tasks

Retrieve open tasks for Agent ID [agent-id], group them by role, and identify tasks awaiting my review.

모범 사례

State whether the user wants onboarding, role guidance, account information, or support.
Provide an Agent ID when requesting task details.
Review every command and financial action before approving it.