📦

okx-guide

Name: okx-guide
Author: okx

v4.4.10 Revisão do conteúdo r1 Risco alto ⚙️ Comandos externos📁 Acesso ao sistema de arquivos🌐 Acesso à rede

Explore Onchain OS and OKX.AI

New users need clear paths through Onchain OS, OKX.AI roles, and support. This skill classifies requests and routes users into focused guided flows.

Suporta: Claude Codex Code(CC)

⚠️ 38 Ruim

Pare e solicite confirmação antes de instalar.

Revise o plano e obtenha o consentimento explícito do usuário antes de alterar arquivos.

Instalar com meu Agente

Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.

Solicitação do agente

Review the Skillstore skill "okx-guide" from https://skillstore.io/skills/okx-okx-guide.md and its manifest at https://skillstore.io/api/skills/okx-okx-guide/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.

Recursos legíveis por agentes

Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.

Detalhe em Markdown GET /skills/okx-okx-guide.md manifest assinado GET /api/skills/okx-okx-guide/manifest lockfile assinado GET /api/skills/okx-okx-guide/lockfile

Testar

Usando "okx-guide". What can Onchain OS help me do?

Resultado esperado:

A localized welcome view explains wallet, trading, market, and payment workflows, then presents the available numbered choices.

Usando "okx-guide". What is the difference between an ASP and an Evaluator?

Resultado esperado:

An ASP offers agent services in the marketplace. An Evaluator reviews disputes and requires the platform-defined staking process.

Usando "okx-guide". I need to report a problem.

Resultado esperado:

The response directs the user to the OKX.AI Help Center and lists the steps for starting a support chat.

Auditoria de segurança

Risco alto

v1 • 20/08/2026 Abrir o relatório versionado

Most static findings are false positives caused by Markdown code spans, fixed relative links, and displayed URLs. Confirmed risks include automatic execution of mutable installation directives and loading hidden home-directory workflows, while semantic review also found unsupported earnings claims.

Arquivos analisados

694

Linhas analisadas

Itens de revisão

Falsos positivos ignorados

Preocupações de segurança confirmadas (2)

Alto

_shared/preflight.md:7-16

Mutable Preflight Directives Can Trigger Commands

The preflight flow says to do exactly what a returned action says, can force an upgrade, and fetches installation commands from a mutable README. A compromised CLI response or upstream document could cause unauthorized command execution.

The file explicitly mandates execution of returned actions and remote installation guidance without an allowlist, pinned artifact, or confirmation step.

Médio

references/intro.md:19-38

Unsupported Financial Outcome Claims

The role-selection copy promotes million-per-year outcomes, round-the-clock earnings, and steadier income while encouraging paid services and OKB staking. These claims can unduly influence financial decisions.

The cited user-facing template contains direct earnings claims and a staking prompt without substantiation or a nearby risk qualification.

Itens de revisão de capacidade (12)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto

_shared/preflight.md:16

PowerShell invocation

- **The `onchainos preflight` command above errored with "command not found"** (onchainos not instal

The fallback directs the agent to fetch current installation instructions and run the matching shell or PowerShell command. This executes mutable remote guidance without showing a pinned command or requiring user approval.

Alto

references/how-to-play.md:54

Hidden file in home directory

- If the user came from picking the **Daily brief** option (option `4` in Variant A / option `3` in

The flow automatically loads and follows a mutable Markdown workflow under the user home directory. Unverified content in that file can introduce commands or instructions outside the audited skill.

Alto

references/how-to-play.md:55

Hidden file in home directory

- If the user came from picking any other **workflow pick** while logged out: automatically load the

The instruction loads a variable workflow file from the hidden Onchain OS directory and follows it automatically. This crosses the audited package boundary without an integrity check.

Alto

references/welcome.md:165

Hidden file in home directory

The menu routes directly to a mutable workflow in the hidden Onchain OS home directory. Following unaudited local Markdown can introduce unsafe instructions.

Alto

references/welcome.md:166

Hidden file in home directory

This second menu variant uses the same hidden home-directory workflow handoff. The file is outside the audited package and lacks integrity validation.

Alto

references/welcome.md:189

Hidden file in home directory

- **Logged-in user**: load `~/.onchainos/workflows/daily-brief.md` directly and follow it.

The instruction explicitly loads and follows the hidden daily-brief workflow for logged-in users. That is an intentional trust boundary crossing.

Alto

SKILL.md:17

Path traversal sequence

**MUST**: Run the shared preflight **only for the onboarding flow** (§1 → `references/how-to-play.md

The onboarding flow actively reads a preflight file outside this skill directory and follows its instructions. Although the path is fixed, the external file can change independently and alter privileged setup behavior.

Médio

references/how-to-play.md:54

Hidden file access

- If the user came from picking the **Daily brief** option (option `4` in Variant A / option `3` in

The line explicitly reads and follows a hidden home-directory workflow. The access is intentional and can expose the agent to mutable local instructions.

Médio

references/how-to-play.md:55

Hidden file access

- If the user came from picking any other **workflow pick** while logged out: automatically load the

The wildcard workflow handoff intentionally accesses hidden local files and executes their guidance. No canonical-path or integrity validation is specified.

Médio

references/welcome.md:165

Hidden file access

The route accesses a hidden local workflow without user confirmation or integrity verification. Its contents can change independently of this audit.

Médio

references/welcome.md:166

Hidden file access

The alternate menu route accesses the same unaudited hidden workflow. This is real filesystem behavior rather than displayed example text.

Médio

references/welcome.md:189

Hidden file access

- **Logged-in user**: load `~/.onchainos/workflows/daily-brief.md` directly and follow it.

The logged-in branch directs the agent to read and follow a hidden local Markdown file. No content validation or trust restriction is stated.

Fatores de risco

⚙️ Comandos externos (7)

_shared/preflight.md:16 SKILL.md:17 SKILL.md:19 SKILL.md:20 SKILL.md:28 SKILL.md:29 SKILL.md:30

📁 Acesso ao sistema de arquivos (19)

references/ai-guide.md:47 references/how-to-play.md:54 references/how-to-play.md:55 references/how-to-play.md:54 references/how-to-play.md:55 references/registered-home.md:12 references/registered-home.md:49 references/registered-home.md:52 references/unregistered-role-selection.md:19 references/unregistered-role-selection.md:20 references/unregistered-role-selection.md:21 references/unregistered-role-selection.md:26 references/welcome.md:165 references/welcome.md:166 references/welcome.md:189 references/welcome.md:165 references/welcome.md:166 references/welcome.md:189 SKILL.md:17

🌐 Acesso à rede (3)

references/ai-support.md:16 references/ai-support.md:22 SKILL.md:8

Auditado por: codex

Compartilhar e citar este relatório

Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.

Abrir o relatório versionado

Copiar link do relatório

https://skillstore.io/skills/okx-okx-guide/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/okx-okx-guide/security.svg)](https://skillstore.io/skills/okx-okx-guide?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/okx-okx-guide?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/okx-okx-guide/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Cartão incorporável

<iframe src="https://skillstore.io/embed/skills/okx-okx-guide.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citações acadêmicas (APA · BibTeX · CFF)

Citação APA

okx. (2026). okx-guide security audit report (audit version 1) [Author version 4.4.10]. Skillstore. https://skillstore.io/skills/okx-okx-guide/audits/1

Citação BibTeX

@techreport{okx-okx-okx-guide-2026,
  author = {okx},
  title = {okx-guide security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/okx-okx-guide/audits/1},
  note = {Author version 4.4.10}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "okx-guide security audit report (audit version 1)"
version: "4.4.10"
type: report
authors:
  - name: "okx"
date-released: "2026-08-20"
url: "https://skillstore.io/skills/okx-okx-guide/audits/1"
identifiers:
  - type: other
    value: "skillstore:okx-okx-guide:audit:1"
    description: "Skillstore immutable audit report identifier"

Comparar variantes

2 variantes instaláveis

Cada autor permanece como um skill instalável separado. A variante recomendada é classificada pelas evidências do Skillstore.

Por que esta variante está em primeiro

Maior uso no Skillstore

Autor / fonte Pontuação do Skillstore Confiança das evidências Uso no Skillstore Atualizado

internet-court Recomendado

internet-court-okx-guide

Pontuação do Skillstore 38

Confiança das evidências Médio

Uso no Skillstore 7

Atualizado

2026-09-09

okx Atual

okx-okx-guide

Pontuação do Skillstore 38

Confiança das evidências Médio

Uso no Skillstore 4

Atualizado

2026-09-09

Pontuação do Skillstore

Por que esta pontuação Confiança das evidências: Médio

Arquitetura

100

Manutenibilidade

Conteúdo

Comunidade

100

Conformidade com a especificação

O que você pode criar

Start with Onchain OS

Present the correct welcome view and route a first-time user toward a supported workflow.

Choose an OKX.AI Role

Explain User, ASP, and Evaluator roles before routing the selected registration flow.

Review Existing Agent Activity

Display registered identities and retrieve open tasks for a selected authenticated agent.

Teste estes prompts

Get Started

Show me how to start using Onchain OS.

Understand OKX.AI Roles

Explain the User, ASP, and Evaluator roles in OKX.AI without starting registration.

Open My Agent Home

Show my registered OKX.AI identities and explain each status. Do not display signing addresses.

Review Agent Tasks

Retrieve open tasks for Agent ID [agent-id], group them by role, and identify tasks awaiting my review.

Boas práticas

State whether the user wants onboarding, role guidance, account information, or support.
Provide an Agent ID when requesting task details.
Review every command and financial action before approving it.