📦

okx-guide

Name: okx-guide
Author: okx

v4.4.10 Ревизия содержимого r1 Высокий риск ⚙️ Внешние команды📁 Доступ к файловой системе🌐 Доступ к сети

Explore Onchain OS and OKX.AI

New users need clear paths through Onchain OS, OKX.AI roles, and support. This skill classifies requests and routes users into focused guided flows.

Поддерживает: Claude Codex Code(CC)

⚠️ 38 Плохо

Остановитесь и запросите подтверждение перед установкой.

Проверьте план и получите явное согласие пользователя перед изменением файлов.

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "okx-guide" from https://skillstore.io/skills/okx-okx-guide.md and its manifest at https://skillstore.io/api/skills/okx-okx-guide/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/okx-okx-guide.md Подписанный manifest GET /api/skills/okx-okx-guide/manifest Подписанный lockfile GET /api/skills/okx-okx-guide/lockfile

Протестировать

Использование «okx-guide». What can Onchain OS help me do?

Ожидаемый результат:

A localized welcome view explains wallet, trading, market, and payment workflows, then presents the available numbered choices.

Использование «okx-guide». What is the difference between an ASP and an Evaluator?

Ожидаемый результат:

An ASP offers agent services in the marketplace. An Evaluator reviews disputes and requires the platform-defined staking process.

Использование «okx-guide». I need to report a problem.

Ожидаемый результат:

The response directs the user to the OKX.AI Help Center and lists the steps for starting a support chat.

Аудит безопасности

Высокий риск

v1 • 20.08.2026 Открыть версионный отчет

Most static findings are false positives caused by Markdown code spans, fixed relative links, and displayed URLs. Confirmed risks include automatic execution of mutable installation directives and loading hidden home-directory workflows, while semantic review also found unsupported earnings claims.

Просканировано файлов

694

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (2)

Высокий

_shared/preflight.md:7-16

Mutable Preflight Directives Can Trigger Commands

The preflight flow says to do exactly what a returned action says, can force an upgrade, and fetches installation commands from a mutable README. A compromised CLI response or upstream document could cause unauthorized command execution.

The file explicitly mandates execution of returned actions and remote installation guidance without an allowlist, pinned artifact, or confirmation step.

Средний

references/intro.md:19-38

Unsupported Financial Outcome Claims

The role-selection copy promotes million-per-year outcomes, round-the-clock earnings, and steadier income while encouraging paid services and OKB staking. These claims can unduly influence financial decisions.

The cited user-facing template contains direct earnings claims and a staking prompt without substantiation or a nearby risk qualification.

Пункты проверки возможностей (12)

Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.

Высокий

_shared/preflight.md:16

PowerShell invocation

- **The `onchainos preflight` command above errored with "command not found"** (onchainos not instal

The fallback directs the agent to fetch current installation instructions and run the matching shell or PowerShell command. This executes mutable remote guidance without showing a pinned command or requiring user approval.

Высокий

references/how-to-play.md:54

Hidden file in home directory

- If the user came from picking the **Daily brief** option (option `4` in Variant A / option `3` in

The flow automatically loads and follows a mutable Markdown workflow under the user home directory. Unverified content in that file can introduce commands or instructions outside the audited skill.

Высокий

references/how-to-play.md:55

Hidden file in home directory

- If the user came from picking any other **workflow pick** while logged out: automatically load the

The instruction loads a variable workflow file from the hidden Onchain OS directory and follows it automatically. This crosses the audited package boundary without an integrity check.

Высокий

references/welcome.md:165

Hidden file in home directory

The menu routes directly to a mutable workflow in the hidden Onchain OS home directory. Following unaudited local Markdown can introduce unsafe instructions.

Высокий

references/welcome.md:166

Hidden file in home directory

This second menu variant uses the same hidden home-directory workflow handoff. The file is outside the audited package and lacks integrity validation.

Высокий

references/welcome.md:189

Hidden file in home directory

- **Logged-in user**: load `~/.onchainos/workflows/daily-brief.md` directly and follow it.

The instruction explicitly loads and follows the hidden daily-brief workflow for logged-in users. That is an intentional trust boundary crossing.

Высокий

SKILL.md:17

Path traversal sequence

**MUST**: Run the shared preflight **only for the onboarding flow** (§1 → `references/how-to-play.md

The onboarding flow actively reads a preflight file outside this skill directory and follows its instructions. Although the path is fixed, the external file can change independently and alter privileged setup behavior.

Средний

references/how-to-play.md:54

Hidden file access

- If the user came from picking the **Daily brief** option (option `4` in Variant A / option `3` in

The line explicitly reads and follows a hidden home-directory workflow. The access is intentional and can expose the agent to mutable local instructions.

Средний

references/how-to-play.md:55

Hidden file access

- If the user came from picking any other **workflow pick** while logged out: automatically load the

The wildcard workflow handoff intentionally accesses hidden local files and executes their guidance. No canonical-path or integrity validation is specified.

Средний

references/welcome.md:165

Hidden file access

The route accesses a hidden local workflow without user confirmation or integrity verification. Its contents can change independently of this audit.

Средний

references/welcome.md:166

Hidden file access

The alternate menu route accesses the same unaudited hidden workflow. This is real filesystem behavior rather than displayed example text.

Средний

references/welcome.md:189

Hidden file access

- **Logged-in user**: load `~/.onchainos/workflows/daily-brief.md` directly and follow it.

The logged-in branch directs the agent to read and follow a hidden local Markdown file. No content validation or trust restriction is stated.

Факторы риска

⚙️ Внешние команды (7)

_shared/preflight.md:16 SKILL.md:17 SKILL.md:19 SKILL.md:20 SKILL.md:28 SKILL.md:29 SKILL.md:30

📁 Доступ к файловой системе (19)

references/ai-guide.md:47 references/how-to-play.md:54 references/how-to-play.md:55 references/how-to-play.md:54 references/how-to-play.md:55 references/registered-home.md:12 references/registered-home.md:49 references/registered-home.md:52 references/unregistered-role-selection.md:19 references/unregistered-role-selection.md:20 references/unregistered-role-selection.md:21 references/unregistered-role-selection.md:26 references/welcome.md:165 references/welcome.md:166 references/welcome.md:189 references/welcome.md:165 references/welcome.md:166 references/welcome.md:189 SKILL.md:17

🌐 Доступ к сети (3)

references/ai-support.md:16 references/ai-support.md:22 SKILL.md:8

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/okx-okx-guide/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/okx-okx-guide/security.svg)](https://skillstore.io/skills/okx-okx-guide?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/okx-okx-guide?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/okx-okx-guide/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/okx-okx-guide.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

okx. (2026). okx-guide security audit report (audit version 1) [Author version 4.4.10]. Skillstore. https://skillstore.io/skills/okx-okx-guide/audits/1

Цитата BibTeX

@techreport{okx-okx-okx-guide-2026,
  author = {okx},
  title = {okx-guide security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/okx-okx-guide/audits/1},
  note = {Author version 4.4.10}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "okx-guide security audit report (audit version 1)"
version: "4.4.10"
type: report
authors:
  - name: "okx"
date-released: "2026-08-20"
url: "https://skillstore.io/skills/okx-okx-guide/audits/1"
identifiers:
  - type: other
    value: "skillstore:okx-okx-guide:audit:1"
    description: "Skillstore immutable audit report identifier"

Сравнить варианты

2 устанавливаемых вариантов

Навык каждого автора остаётся отдельным устанавливаемым вариантом. Рекомендуемый вариант ранжируется по данным Skillstore.

Почему этот вариант первый

Больше использования в Skillstore

Автор / источник Оценка Skillstore Достоверность доказательств Использование в Skillstore Обновлено

internet-court Рекомендуется

internet-court-okx-guide

Оценка Skillstore 38

Достоверность доказательств Средний

Использование в Skillstore 6

Обновлено

2026-09-09

okx Текущий

okx-okx-guide

Оценка Skillstore 38

Достоверность доказательств Средний

Использование в Skillstore 2

Обновлено

2026-09-09

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

100

Сопровождаемость

Контент

Сообщество

100

Соответствие спецификации

Что вы можете построить

Start with Onchain OS

Present the correct welcome view and route a first-time user toward a supported workflow.

Choose an OKX.AI Role

Explain User, ASP, and Evaluator roles before routing the selected registration flow.

Review Existing Agent Activity

Display registered identities and retrieve open tasks for a selected authenticated agent.

Попробуйте эти промпты

Get Started

Show me how to start using Onchain OS.

Understand OKX.AI Roles

Explain the User, ASP, and Evaluator roles in OKX.AI without starting registration.

Open My Agent Home

Show my registered OKX.AI identities and explain each status. Do not display signing addresses.

Review Agent Tasks

Retrieve open tasks for Agent ID [agent-id], group them by role, and identify tasks awaiting my review.

Лучшие практики

State whether the user wants onboarding, role guidance, account information, or support.
Provide an Agent ID when requesting task details.
Review every command and financial action before approving it.