Versioned security assessment

Report ID: SA-3F6E026A

7/21/2026, 4:09:26 AM

okx-dapp-discovery security assessment v2

Skill Security Certification Report

Audit History

Scanner version 3.0.0 Audit model: claude Latest published report

Skill name: okx-dapp-discovery
Version: v4.2.1
Maintainer: internet-court
Source: github.com/internet-court/internet-court-skill/tree/main/vendored/okx/okx-dapp-discovery
Coverage: 3 Files scanned · 621 Lines analyzed
Policy version: skillstore-security-audit-policy-v1

Highest confirmed finding severity

High

2 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill contains many benign documentation references that triggered static rules. However, it silently installs third-party plugins globally and builds a shell command from a user-supplied DApp name before probing and installing packages. Those behaviors create supply-chain and command-injection exposure.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Attestation unavailable

No public attestation is available for this report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

3 Files scanned · 621 Lines analyzed

17 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

Source

Commit and path bound
Artifact

Content and tree hashes bound
Audit

Complete
Install contract

Open manifest to verify
Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 2 evidence locations

Filesystem access

May read or write local files.

Observed in 10 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 58 evidence locations

Capability review items (15)

Medium

SKILL.md:167-182

Ruby/shell backtick execution

```bash

This documentation instructs the agent to execute a shell command or command substitution. The behavior is operational, even where its stated purpose is skill discovery or catalog parsing.

Medium

SKILL.md:182-186

Ruby/shell backtick execution

```

This documentation instructs the agent to execute a shell command or command substitution. The behavior is operational, even where its stated purpose is skill discovery or catalog parsing.

Medium

SKILL.md:188-193

Ruby/shell backtick execution

```bash

This documentation instructs the agent to execute a shell command or command substitution. The behavior is operational, even where its stated purpose is skill discovery or catalog parsing.

Medium

SKILL.md:275-302

Ruby/shell backtick execution

```bash

This documentation instructs the agent to execute a shell command or command substitution. The behavior is operational, even where its stated purpose is skill discovery or catalog parsing.

Medium

SKILL.md:302-304

Ruby/shell backtick execution

```

This documentation instructs the agent to execute a shell command or command substitution. The behavior is operational, even where its stated purpose is skill discovery or catalog parsing.

Medium

SKILL.md:168

Shell command substitution

SKILLS_LIST=$(npx skills list 2>/dev/null)

This instruction runs npx skills list to inspect installed skills. It executes an external command, although its stated purpose is limited to an installed-status check.

Medium

SKILL.md:277

Shell command substitution

DAPP_LOWER=$(echo "<DApp name as user typed it>" | tr 'A-Z' 'a-z' | tr -d '.')

This documentation instructs the agent to execute a shell command or command substitution. The behavior is operational, even where its stated purpose is skill discovery or catalog parsing.

Medium

SKILL.md:279-280

Shell command substitution

CATALOG=$(curl -fsSL --max-time 5 "https://api.github.com/repos/okx/plugin-store/contents/skills" 2>

The catalog probe executes curl and processes remote response data in a shell pipeline. It is a real external command and depends on an external service.

Medium

SKILL.md:284

Shell command substitution

MATCHES=$(echo "$CATALOG" | grep -E "^${DAPP_LOWER}(-|$)" || true)

This documentation instructs the agent to execute a shell command or command substitution. The behavior is operational, even where its stated purpose is skill discovery or catalog parsing.

Medium

SKILL.md:285

Shell command substitution

COUNT=$(echo "$MATCHES" | grep -c . 2>/dev/null || echo 0)

This documentation instructs the agent to execute a shell command or command substitution. The behavior is operational, even where its stated purpose is skill discovery or catalog parsing.

Medium

SKILL.md:288

Shell command substitution

1) TARGET_PLUGIN=$(echo "$MATCHES" | head -1)

This documentation instructs the agent to execute a shell command or command substitution. The behavior is operational, even where its stated purpose is skill discovery or catalog parsing.

Medium

SKILL.md:167-182

Template literal with command substitution

```bash

This documentation instructs the agent to execute a shell command or command substitution. The behavior is operational, even where its stated purpose is skill discovery or catalog parsing.

Medium

SKILL.md:275-302

Template literal with command substitution

```bash

This documentation instructs the agent to execute a shell command or command substitution. The behavior is operational, even where its stated purpose is skill discovery or catalog parsing.

Medium

SKILL.md:195

Hidden file access

Read file: $HOME/.claude/skills/<plugin-name>/SKILL.md

The instruction reads an installed plugin file from the user home directory after installation. This is a real local file access, though constrained to the skills directory.

Low

SKILL.md:279

Hardcoded URL

CATALOG=$(curl -fsSL --max-time 5 "https://api.github.com/repos/okx/plugin-store/contents/skills" 2>

The instruction makes an outbound request to the GitHub Contents API. It is a real network operation, although the endpoint is a stated public catalog.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 High

SKILL.md:275-280

Untrusted DApp Name Reaches Shell Source

The catalog probe instructs substitution of the user-typed DApp name inside a double-quoted shell command. A quote or shell expansion in that value can alter the command before normalization.

The placeholder is explicitly described as user-typed and appears inside shell source. No escaping or allowlist is specified before the shell evaluates it.

RISK-002 High

SKILL.md:184-198 SKILL.md:286-297

Silent Third-Party Plugin Installation

The routing flow directs global installation of selected third-party plugins without confirmation. The later binary gate covers plugin pre-flight binaries but not the initial package installation.

The instructions explicitly say to install silently and use the global flag. The consent gate begins only after the plugin is installed and read.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

FIX-001
High
Automatic global plugin installation

Require explicit user confirmation before every npx skills add command, show the exact plugin and source, and avoid the global flag by default.
FIX-002
High
User-provided DApp name is inserted into shell source

Do not interpolate user text into shell commands. Pass it as a positional argument or validate it against a strict allowlist before use.
FIX-003
Medium
Remote catalog and package content is trusted without integrity controls

Use an allowlisted catalog with pinned versions and integrity verification before installing or loading third-party plugins.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit: 3f6e026a3363e0954ede7bef0cfe88d4475de137
Content hash: 7db7c48ef25fc8b5d18bf057f31fc0024d9151ceb2861f4451b603e396dbd5a8
Tree hash: 49031b36431bb157e218b2af91b5d5a36f1d332051015726b7fa4e9d1796e8c6
Skill path: skills/internet-court/okx-dapp-discovery
Audit payload hash: 98994e7acd2430566a07b0b3e992f963

Analysis metadata

Audit model: claude

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: unavailable