📦
Audit History
okx-agent-payments-protocol - 2 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 2 Latest
Jul 21, 2026, 04:04 AM
Most static matches are false positives caused by Markdown code formatting, relative documentation links, protocol literals, and security-oriented guidance. Four findings are confirmed because the local-key fallback reads EVM_PRIVATE_KEY from the environment or ~/.onchainos/.env to authorize payment signing. No prompt-injection, credential-exfiltration, or covert network-intent evidence was found in the reviewed material.
9
Files scanned
1,248
Lines analyzed
9
Review items
0
False positives ignored
Confirmed security concerns (1)
High
Environment file access
Reads `EVM_PRIVATE_KEY` (env var or `~/.onchainos/.env`), derives the payer, generates the nonce, co
The workflow directs the local-key fallback to read EVM_PRIVATE_KEY from the environment or a local environment file. This creates credential-exposure and signing risk.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hidden file in home directory
Reads `EVM_PRIVATE_KEY` (env var or `~/.onchainos/.env`), derives the payer, generates the nonce, co
The documented local-key fallback reads a private key from ~/.onchainos/.env. Accessing a wallet credential on the host has material compromise impact if the CLI or environment is unsafe.
High
Generic API/secret keys
Reads `EVM_PRIVATE_KEY` (env var or `~/.onchainos/.env`), derives the payer, generates the nonce, co
The documented local-key fallback reads EVM_PRIVATE_KEY to sign payments. A private key is a high-value credential and its use can authorize financial transactions.
Medium
Hidden file access
Reads `EVM_PRIVATE_KEY` (env var or `~/.onchainos/.env`), derives the payer, generates the nonce, co
The local-key fallback explicitly accesses ~/.onchainos/.env to obtain a wallet credential. This is sensitive host-file access with high impact if exposed.
Risk Factors
📁 Filesystem access (12)
references/a2a_charge.md:3 references/a2a_charge.md:129 references/accepts-schemes.md:3 references/accepts-schemes.md:40 references/accepts-schemes.md:40 references/charge.md:3 references/charge.md:70 references/session.md:3 references/session.md:70 references/session.md:321 references/subscription.md:3 SKILL.md:62
🔑 Env variables (2)
⚡ Contains scripts (1)
⚙️ External commands (50)
SKILL.md:17 SKILL.md:19 SKILL.md:23 SKILL.md:27 SKILL.md:29 SKILL.md:33 SKILL.md:42 SKILL.md:43 SKILL.md:54 SKILL.md:55 SKILL.md:56 SKILL.md:58 SKILL.md:62 SKILL.md:70 SKILL.md:71 SKILL.md:72 SKILL.md:73 SKILL.md:74 SKILL.md:76 SKILL.md:78 SKILL.md:88 SKILL.md:92-100 SKILL.md:100-104 SKILL.md:104 SKILL.md:113 SKILL.md:119-124 SKILL.md:124-128 SKILL.md:128-131 SKILL.md:131-133 SKILL.md:133 SKILL.md:139-141 SKILL.md:141-143 SKILL.md:143-145 SKILL.md:145-159 SKILL.md:159-161 SKILL.md:161 SKILL.md:163 SKILL.md:165 SKILL.md:171 SKILL.md:173-175 SKILL.md:175 SKILL.md:179 SKILL.md:180 SKILL.md:181 SKILL.md:183 SKILL.md:187-189 SKILL.md:189 SKILL.md:190-197 SKILL.md:197 SKILL.md:201-203
🌐 Network access (2)
Audited by: claude
Jul 9, 2026, 11:54 PM
Most static matches are Markdown protocol references, command examples, or required base64 header handling rather than executable malware patterns. Confirmed risks are local private-key fallback access, hidden credential-file use, and a sibling preflight instruction read outside the audited package. Additional semantic risks include a2a buyer payment without a local confirmation gate and preflight behavior that can auto-update or run a downloaded installer.
9
Files scanned
1,248
Lines analyzed
14
Review items
0
False positives ignored
Confirmed security concerns (4)
High
Environment file access
Reads `EVM_PRIVATE_KEY` (env var or `~/.onchainos/.env`), derives the payer, generates the nonce, co
The local-key fallback explicitly reads EVM_PRIVATE_KEY from the environment or ~/.onchainos/.env and signs payments on the host. That is direct access to a high-value wallet credential, even though it is documented as a fallback.
High
Crypto seed/private key mention
- **Not logged in (`accepts`-based path)** → ask the user to choose between (1) wallet login (TEE si
The dispatcher offers a local private-key fallback for accepts-based payments after user selection. Even with the stated gate, enabling host-side key use is a real wallet credential risk.
High
Buyer Payment Without Local Confirmation Gate
The a2a buyer path says the skill does not run its own preview or yes-no gate and shells out directly to pay. This can sign and submit the server challenge without showing the buyer the amount, token, or recipient in this skill.
The cited section explicitly skips the local confirmation gate and immediately runs the pay command. The same section states the CLI fetches and signs the on-server challenge.
High
Unpinned Auto-Update and Installer Execution
The preflight flow states that the binary and skill checkouts are updated automatically, and the fallback downloads and runs the latest installer. This creates supply-chain risk unless the trust root and user approval are explicit.
The file directly describes automatic updates and running a downloaded installer after a checksum check. The source and checksum trust root are not pinned in the audited skill text.
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hidden file in home directory
Reads `EVM_PRIVATE_KEY` (env var or `~/.onchainos/.env`), derives the payer, generates the nonce, co
The local-key fallback reads the hidden file ~/.onchainos/.env for EVM_PRIVATE_KEY. That file can contain a wallet private key used to sign payment authorizations on the host.
High
Hidden file access
Reads `EVM_PRIVATE_KEY` (env var or `~/.onchainos/.env`), derives the payer, generates the nonce, co
The local-key fallback reads ~/.onchainos/.env when EVM_PRIVATE_KEY is not supplied directly. Accessing a hidden credential file is a real host-secret handling risk.
High
Generic API/secret keys
Reads `EVM_PRIVATE_KEY` (env var or `~/.onchainos/.env`), derives the payer, generates the nonce, co
The local-key fallback explicitly reads EVM_PRIVATE_KEY from the environment or ~/.onchainos/.env and signs payments on the host. That is direct access to a high-value wallet credential, even though it is documented as a fallback.
High
Generic API/secret keys
- Local-key fallback signs entirely on the host — treat `EVM_PRIVATE_KEY` as a credential (`chmod 60
The security section confirms local-key signing uses EVM_PRIVATE_KEY as a credential. This creates real credential-handling risk on the host compared with the TEE path.
High
Path traversal sequence
Read `../okx-agentic-wallet/_shared/preflight.md` (fallback: `_shared/preflight.md`).
The skill instructs the agent to read ../okx-agentic-wallet/_shared/preflight.md, which is outside this package. Loading unaudited sibling instructions can change behavior beyond the reviewed skill contents.
Risk Factors
📁 Filesystem access (12)
references/a2a_charge.md:3 references/a2a_charge.md:129 references/accepts-schemes.md:3 references/accepts-schemes.md:40 references/accepts-schemes.md:40 references/charge.md:3 references/charge.md:70 references/session.md:3 references/session.md:70 references/session.md:321 references/subscription.md:3 SKILL.md:62
🔑 Env variables (2)
⚡ Contains scripts (1)
⚙️ External commands (50)
SKILL.md:17 SKILL.md:19 SKILL.md:23 SKILL.md:27 SKILL.md:29 SKILL.md:33 SKILL.md:42 SKILL.md:43 SKILL.md:54 SKILL.md:55 SKILL.md:56 SKILL.md:58 SKILL.md:62 SKILL.md:70 SKILL.md:71 SKILL.md:72 SKILL.md:73 SKILL.md:74 SKILL.md:76 SKILL.md:78 SKILL.md:88 SKILL.md:92-100 SKILL.md:100-104 SKILL.md:104 SKILL.md:113 SKILL.md:119-124 SKILL.md:124-128 SKILL.md:128-131 SKILL.md:131-133 SKILL.md:133 SKILL.md:139-141 SKILL.md:141-143 SKILL.md:143-145 SKILL.md:145-159 SKILL.md:159-161 SKILL.md:161 SKILL.md:163 SKILL.md:165 SKILL.md:171 SKILL.md:173-175 SKILL.md:175 SKILL.md:179 SKILL.md:180 SKILL.md:181 SKILL.md:183 SKILL.md:187-189 SKILL.md:189 SKILL.md:190-197 SKILL.md:197 SKILL.md:201-203
🌐 Network access (2)
Audited by: codex