Skills okx-agent-payments-protocol

📦

okx-agent-payments-protocol

Name: okx-agent-payments-protocol
Author: internet-court

v4.2.1 Content revision r1 High Risk 📁 Filesystem access🔑 Env variables⚡ Contains scripts⚙️ External commands🌐 Network access

Handle OKX Agent Payment Flows

Paid agent endpoints often require careful signing, confirmation, and replay steps. This skill guides Claude, Codex, and Claude Code through OKX Agent Payments Protocol flows.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "okx-agent-payments-protocol" from https://skillstore.io/skills/internet-court-okx-agent-payments-protocol.md and its manifest at https://skillstore.io/api/skills/internet-court-okx-agent-payments-protocol/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/internet-court-okx-agent-payments-protocol.md Signed manifest GET /api/skills/internet-court-okx-agent-payments-protocol/manifest Signed lockfile GET /api/skills/internet-court-okx-agent-payments-protocol/lockfile

Test it

Using "okx-agent-payments-protocol". I need to access a paid weather endpoint that returned HTTP 402.

Expected outcome:

Shows the required network, token, amount, recipient, and request parameters.
Asks for explicit confirmation before checking wallet status or signing.
After payment, reports the settlement result and suggests a balance check.

Using "okx-agent-payments-protocol". Create a payment link for 0.01 USDT to my seller wallet.

Expected outcome:

Confirms the payment link was created.
Displays the payment identifier, amount, recipient, and shareable link when available.
Suggests checking status after the buyer pays.

Using "okx-agent-payments-protocol". Close my active payment channel after the final request.

Expected outcome:

Uses the saved channel state to close the channel.
Shows the charged amount, prepaid balance, refund amount, and on-chain transaction reference.

Security Audit

High Risk

v2 • 7/21/2026 Open versioned report

Most static matches are false positives caused by Markdown code formatting, relative documentation links, protocol literals, and security-oriented guidance. Four findings are confirmed because the local-key fallback reads EVM_PRIVATE_KEY from the environment or ~/.onchainos/.env to authorize payment signing. No prompt-injection, credential-exfiltration, or covert network-intent evidence was found in the reviewed material.

Files scanned

1,248

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

High

references/accepts-schemes.md:40

Environment file access

Reads `EVM_PRIVATE_KEY` (env var or `~/.onchainos/.env`), derives the payer, generates the nonce, co

The workflow directs the local-key fallback to read EVM_PRIVATE_KEY from the environment or a local environment file. This creates credential-exposure and signing risk.

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/accepts-schemes.md:40

Hidden file in home directory

Reads `EVM_PRIVATE_KEY` (env var or `~/.onchainos/.env`), derives the payer, generates the nonce, co

The documented local-key fallback reads a private key from ~/.onchainos/.env. Accessing a wallet credential on the host has material compromise impact if the CLI or environment is unsafe.

High

references/accepts-schemes.md:40

Generic API/secret keys

Reads `EVM_PRIVATE_KEY` (env var or `~/.onchainos/.env`), derives the payer, generates the nonce, co

The documented local-key fallback reads EVM_PRIVATE_KEY to sign payments. A private key is a high-value credential and its use can authorize financial transactions.

Medium

references/accepts-schemes.md:40

Hidden file access

Reads `EVM_PRIVATE_KEY` (env var or `~/.onchainos/.env`), derives the payer, generates the nonce, co

The local-key fallback explicitly accesses ~/.onchainos/.env to obtain a wallet credential. This is sensitive host-file access with high impact if exposed.

Risk Factors

📁 Filesystem access (12)

references/a2a_charge.md:3 references/a2a_charge.md:129 references/accepts-schemes.md:3 references/accepts-schemes.md:40 references/accepts-schemes.md:40 references/charge.md:3 references/charge.md:70 references/session.md:3 references/session.md:70 references/session.md:321 references/subscription.md:3 SKILL.md:62

🔑 Env variables (2)

references/accepts-schemes.md:40 references/accepts-schemes.md:82

⚡ Contains scripts (1)

SKILL.md:180

⚙️ External commands (50)

🌐 Network access (2)

SKILL.md:8 SKILL.md:29

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/internet-court-okx-agent-payments-protocol/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/internet-court-okx-agent-payments-protocol/security.svg)](https://skillstore.io/skills/internet-court-okx-agent-payments-protocol?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/internet-court-okx-agent-payments-protocol?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-okx-agent-payments-protocol/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/internet-court-okx-agent-payments-protocol.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

internet-court. (2026). okx-agent-payments-protocol security audit report (audit version 2) [Author version 4.2.1]. Skillstore. https://skillstore.io/skills/internet-court-okx-agent-payments-protocol/audits/2

BibTeX citation

@techreport{internet-court-internet-court-okx-agent-payments-protocol-2026,
  author = {internet-court},
  title = {okx-agent-payments-protocol security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/internet-court-okx-agent-payments-protocol/audits/2},
  note = {Author version 4.2.1}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "okx-agent-payments-protocol security audit report (audit version 2)"
version: "4.2.1"
type: report
authors:
  - name: "internet-court"
date-released: "2026-07-21"
url: "https://skillstore.io/skills/internet-court-okx-agent-payments-protocol/audits/2"
identifiers:
  - type: other
    value: "skillstore:internet-court-okx-agent-payments-protocol:audit:2"
    description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Stronger evidence confidence

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

internet-court Recommended Current

internet-court-okx-agent-payments-protocol

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 6

Updated

2026-09-09

okx

okx-okx-agent-payments-protocol

Skillstore Score 38

Evidence Confidence Low

Skillstore usage 2

Updated

2026-09-09

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Access paid agent endpoints

Handle HTTP 402 responses, show payment details, collect confirmation, sign, and replay the protected request.

Manage payment channels

Open a prepaid session, issue vouchers, top up balance, and close the channel with clear state tracking.

Operate a2a payment links

Create seller links, pay buyer links, poll status, and present terminal payment states in plain language.

Try These Prompts

Pay a protected endpoint

Call <endpoint URL>. If it returns a payment requirement, show the charge details and wait for my confirmation before payment.

Create a payment link

Create an a2a payment link for <amount> <symbol> to <recipient address> with description <description>.

Continue a channel session

Use channel <channel_id> to make another request to <business URL>. Track the cumulative amount and show the channel state.

Compare payment schemes

For this HTTP 402 response, compare the available OKX Agent Payments Protocol options, recommend one, and wait for confirmation.

Best Practices

Confirm each payment with amount, token, network, recipient, and request parameters before signing.
Prefer TEE wallet signing over local private key fallback when possible.
Keep channel identifiers, escrow address, chain ID, deposit, cumulative amount, and signature in conversation state.