π¦
Audit History
okx-dapp-discovery - 2 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 2 Latest
Jul 21, 2026, 04:09 AM
The skill contains many benign documentation references that triggered static rules. However, it silently installs third-party plugins globally and builds a shell command from a user-supplied DApp name before probing and installing packages. Those behaviors create supply-chain and command-injection exposure.
3
Files scanned
621
Lines analyzed
20
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Untrusted DApp Name Reaches Shell Source
The catalog probe instructs substitution of the user-typed DApp name inside a double-quoted shell command. A quote or shell expansion in that value can alter the command before normalization.
The placeholder is explicitly described as user-typed and appears inside shell source. No escaping or allowlist is specified before the shell evaluates it.
High
Silent Third-Party Plugin Installation
The routing flow directs global installation of selected third-party plugins without confirmation. The later binary gate covers plugin pre-flight binaries but not the initial package installation.
The instructions explicitly say to install silently and use the global flag. The consent gate begins only after the plugin is installed and read.
Capability review items (15)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution Β· 3 occurrences
```bash
This documentation instructs the agent to execute a shell command or command substitution. The behavior is operational, even where its stated purpose is skill discovery or catalog parsing.
Medium
Ruby/shell backtick execution Β· 2 occurrences
```
This documentation instructs the agent to execute a shell command or command substitution. The behavior is operational, even where its stated purpose is skill discovery or catalog parsing.
Medium
Shell command substitution
SKILLS_LIST=$(npx skills list 2>/dev/null)
This instruction runs npx skills list to inspect installed skills. It executes an external command, although its stated purpose is limited to an installed-status check.
Medium
Shell command substitution
DAPP_LOWER=$(echo "<DApp name as user typed it>" | tr 'A-Z' 'a-z' | tr -d '.')
This documentation instructs the agent to execute a shell command or command substitution. The behavior is operational, even where its stated purpose is skill discovery or catalog parsing.
Medium
Shell command substitution
CATALOG=$(curl -fsSL --max-time 5 "https://api.github.com/repos/okx/plugin-store/contents/skills" 2>
The catalog probe executes curl and processes remote response data in a shell pipeline. It is a real external command and depends on an external service.
Medium
Shell command substitution
MATCHES=$(echo "$CATALOG" | grep -E "^${DAPP_LOWER}(-|$)" || true)
This documentation instructs the agent to execute a shell command or command substitution. The behavior is operational, even where its stated purpose is skill discovery or catalog parsing.
Medium
Shell command substitution
COUNT=$(echo "$MATCHES" | grep -c . 2>/dev/null || echo 0)
This documentation instructs the agent to execute a shell command or command substitution. The behavior is operational, even where its stated purpose is skill discovery or catalog parsing.
Medium
Shell command substitution
1) TARGET_PLUGIN=$(echo "$MATCHES" | head -1)
This documentation instructs the agent to execute a shell command or command substitution. The behavior is operational, even where its stated purpose is skill discovery or catalog parsing.
Medium
Template literal with command substitution Β· 2 occurrences
```bash
This documentation instructs the agent to execute a shell command or command substitution. The behavior is operational, even where its stated purpose is skill discovery or catalog parsing.
Medium
Hidden file access
Read file: $HOME/.claude/skills/<plugin-name>/SKILL.md
The instruction reads an installed plugin file from the user home directory after installation. This is a real local file access, though constrained to the skills directory.
Low
Hardcoded URL
CATALOG=$(curl -fsSL --max-time 5 "https://api.github.com/repos/okx/plugin-store/contents/skills" 2>
The instruction makes an outbound request to the GitHub Contents API. It is a real network operation, although the endpoint is a stated public catalog.
Risk Factors
βοΈ External commands (50)
SKILL.md:6 SKILL.md:18 SKILL.md:28 SKILL.md:30 SKILL.md:35 SKILL.md:36 SKILL.md:42 SKILL.md:74 SKILL.md:84 SKILL.md:88 SKILL.md:94 SKILL.md:104 SKILL.md:106 SKILL.md:108 SKILL.md:119 SKILL.md:123 SKILL.md:125 SKILL.md:130 SKILL.md:134 SKILL.md:135 SKILL.md:138 SKILL.md:163 SKILL.md:167-182 SKILL.md:182-186 SKILL.md:186 SKILL.md:188-193 SKILL.md:193-194 SKILL.md:194-196 SKILL.md:196-202 SKILL.md:202 SKILL.md:204 SKILL.md:206 SKILL.md:209 SKILL.md:211 SKILL.md:217-218 SKILL.md:218 SKILL.md:224-228 SKILL.md:228-229 SKILL.md:229-230 SKILL.md:230-231 SKILL.md:231-232 SKILL.md:232-233 SKILL.md:233-234 SKILL.md:234-235 SKILL.md:235-236 SKILL.md:236-237 SKILL.md:237-238 SKILL.md:238-239 SKILL.md:239-240 SKILL.md:240
π Network access (2)
Audited by: claude
Jul 10, 2026, 12:12 AM
Most static findings are false positives caused by Markdown backticks, DeFi protocol vocabulary, and /dev/null redirection. Real risks remain around package-manager plugin installation, outbound GitHub catalog probing, and downstream binary pre-flight installers that may place executables under hidden home-directory paths.
3
Files scanned
621
Lines analyzed
26
Review items
0
False positives ignored
Confirmed security concerns (1)
High
Silent Third-Party Plugin Installation And Prompt Forwarding
The skill can install plugins from okx/plugin-store with --yes --global and then immediately forward the original user prompt into the newly loaded plugin. This expands the trust boundary from this router to downstream plugin code and instructions.
The install and forward flow is explicitly documented with npx skills add and immediate re-application of the user request. The catalog-probe fallback can install a discovered plugin without a separate trust review.
Capability review items (22)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
**Step A β detect** any of: a `# BINARY_INSTALL:` marker; `curl ... github.com/.*/releases/`; downlo
The line enumerates curl downloads, chmod, launcher scripts, and PATH symlinks as binary installer indicators. It is framed as detection, but confirms a material downstream command-execution risk.
High
Ruby/shell backtick execution
> Plugin: `<name>` v`<version>` Β· Binary: `<release-URL>` Β· Scripts: `launcher.sh`, `update-checker.
The consent prompt includes release binaries and downloaded scripts that would be installed under the user profile. This is a real executable-content risk even with explicit approval.
High
Hidden file in home directory
Plugin SKILL.md files often include a "Pre-flight Dependencies" section that downloads pre-compiled
This line states that downstream pre-flight installers may place binaries under a hidden path in the user profile. The consent gate mitigates silent execution, but the hidden binary install risk is real.
High
Hidden file in home directory
**Step A β detect** any of: a `# BINARY_INSTALL:` marker; `curl ... github.com/.*/releases/`; downlo
This line names hidden PATH installation and symlink indicators for downloaded binaries. It is detection-oriented, but confirms the workflow may encounter high-risk filesystem changes.
High
Hidden file in home directory
> Plugin: `<name>` v`<version>` Β· Binary: `<release-URL>` Β· Scripts: `launcher.sh`, `update-checker.
The consent text identifies installation into ~/.local/bin/.<plugin>-core. Hidden executable placement under the home directory is a real risk even when disclosed.
High
Symlink creation
**Step A β detect** any of: a `# BINARY_INSTALL:` marker; `curl ... github.com/.*/releases/`; downlo
The line references ln -sf into ~/.local/bin or another PATH directory. Creating symlinks to downloaded executables in PATH is a real high-impact filesystem risk.
Medium
Ruby/shell backtick execution
Set `TARGET_PLUGIN` from Β§5 and run Β§4 (installed-check β install if needed β read SKILL.md β Binary
This line directs the agent to run the installation workflow in section 4, which invokes package-manager commands. The exact command is elsewhere, but the routing intent creates a real external-command trust boundary.
Medium
Ruby/shell backtick execution
Run Β§6 catalog probe (~0.1s). If `<dappName>-plugin` exists β install + forward. If not β surface th
This line tells the agent to run the catalog probe and install a matching plugin. That introduces network and package-manager execution beyond passive documentation.
Medium
Ruby/shell backtick execution
`TARGET_PLUGIN` is set from Β§5. If already in `$INSTALLED_PLUGINS`, skip the installation; otherwise
The surrounding install section says absent plugins are installed silently. This is a real external-command workflow even though the line itself is descriptive.
Medium
Ruby/shell backtick execution
Plugin SKILL.md files often include a "Pre-flight Dependencies" section that downloads pre-compiled
The line describes downstream pre-flight steps that download binaries and shell scripts. The later consent gate mitigates it, but the workflow still exposes users to external executable content.
Medium
Ruby/shell backtick execution
- **Failure mode:** if `npx skills add` fails (network/registry), tell the user: "I couldn't install
The failure message instructs the user to run npx skills add manually. It is user-mediated, but still directs external package-manager execution.
Medium
Ruby/shell backtick execution
Use **only** when the user named a DApp NOT in Β§5 (step 3). For table DApps, set `TARGET_PLUGIN` fro
This line directs the agent to probe the GitHub Contents API and mentions command-line fallbacks. The workflow performs network access and local command execution.
Medium
Shell command substitution
SKILLS_LIST=$(npx skills list 2>/dev/null)
The line executes npx through command substitution to list installed skills. It is a bounded command, but it still runs an external package-manager tool.
Medium
Shell command substitution
DAPP_LOWER=$(echo "<DApp name as user typed it>" | tr 'A-Z' 'a-z' | tr -d '.')
The line uses shell command substitution to normalize a user-named DApp. It is quoted and simple, but it still executes shell utilities on user-derived text.
Medium
Shell command substitution
CATALOG=$(curl -fsSL --max-time 5 "https://api.github.com/repos/okx/plugin-store/contents/skills" 2>
The line executes curl and python3 in command substitution to fetch and parse a remote plugin catalog. This is clear network-backed command execution.
Medium
Shell command substitution
MATCHES=$(echo "$CATALOG" | grep -E "^${DAPP_LOWER}(-|$)" || true)
The line runs grep against a user-derived plugin prefix. Quoting limits shell injection, but regex behavior can still affect catalog matching.
Medium
Shell command substitution
COUNT=$(echo "$MATCHES" | grep -c . 2>/dev/null || echo 0)
The line executes grep and echo to count matches. It is low complexity, but it is still shell command substitution in the routing flow.
Medium
Shell command substitution
1) TARGET_PLUGIN=$(echo "$MATCHES" | head -1)
The line executes head inside command substitution to choose a plugin match. The selected value later controls installation, so it remains a relevant external-command risk.
Medium
Hardcoded URL
CATALOG=$(curl -fsSL --max-time 5 "https://api.github.com/repos/okx/plugin-store/contents/skills" 2>
The catalog probe calls the GitHub API with curl. It does not appear to send secrets, but it is explicit outbound network access during routing.
Medium
Hidden file access
Plugin SKILL.md files often include a "Pre-flight Dependencies" section that downloads pre-compiled
The line describes downstream binary installers that write under hidden user-profile paths. Consent is required later, but the filesystem risk is still present.
Medium
Hidden file access
**Step A β detect** any of: a `# BINARY_INSTALL:` marker; `curl ... github.com/.*/releases/`; downlo
The line explicitly references hidden PATH installation and symlink indicators. It is a guardrail, but it confirms sensitive filesystem operations may be part of downstream plugin setup.
Medium
Hidden file access
> Plugin: `<name>` v`<version>` Β· Binary: `<release-URL>` Β· Scripts: `launcher.sh`, `update-checker.
The consent prompt includes the hidden install target ~/.local/bin/.<plugin>-core. That is a real hidden-file access concern, although it is disclosed to the user.
Risk Factors
βοΈ External commands (50)
SKILL.md:6 SKILL.md:18 SKILL.md:28 SKILL.md:30 SKILL.md:35 SKILL.md:36 SKILL.md:42 SKILL.md:74 SKILL.md:84 SKILL.md:88 SKILL.md:94 SKILL.md:104 SKILL.md:106 SKILL.md:108 SKILL.md:119 SKILL.md:123 SKILL.md:125 SKILL.md:130 SKILL.md:134 SKILL.md:135 SKILL.md:138 SKILL.md:163 SKILL.md:167-182 SKILL.md:182-186 SKILL.md:186 SKILL.md:188-193 SKILL.md:193-194 SKILL.md:194-196 SKILL.md:196-202 SKILL.md:202 SKILL.md:204 SKILL.md:206 SKILL.md:209 SKILL.md:211 SKILL.md:217-218 SKILL.md:218 SKILL.md:224-228 SKILL.md:228-229 SKILL.md:229-230 SKILL.md:230-231 SKILL.md:231-232 SKILL.md:232-233 SKILL.md:233-234 SKILL.md:234-235 SKILL.md:235-236 SKILL.md:236-237 SKILL.md:237-238 SKILL.md:238-239 SKILL.md:239-240 SKILL.md:240
π Network access (2)
Audited by: codex