π¦
Audit History
okx-dex - 2 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 2 Latest
Jul 21, 2026, 04:12 AM
Static detections are predominantly documentation false positives: inline code, placeholder credentials, fixed file references, and illustrative URLs. However, the shared preflight procedure authorizes arbitrary non-null CLI action data, including forced upgrades, so it creates a critical trust-boundary failure.
30
Files scanned
4,763
Lines analyzed
5
Review items
0
False positives ignored
Confirmed security concerns (1)
Critical
Untrusted Preflight Action Can Direct Agent Behavior
The preflight procedure directs the agent to execute whatever non-null data.action says, including forced upgrades. A compromised CLI, update channel, or manipulated response could cause unauthorized installation or other actions.
The instruction explicitly treats external command output as authoritative and says to do exactly what it says. The permitted examples include a forced upgrade, which is consequential agent behavior.
Risk Factors
βοΈ External commands (15)
π Filesystem access (40)
_shared/payment-notifications.md:129 _shared/payment-notifications.md:129 references/market.md:15 references/market.md:16 references/market.md:17 references/market.md:15 references/market.md:16 references/market.md:17 references/signal.md:15 references/signal.md:16 references/signal.md:17 references/signal.md:18 references/signal.md:19 references/signal.md:15 references/signal.md:16 references/signal.md:17 references/signal.md:18 references/signal.md:19 references/social-troubleshooting.md:35 references/social-troubleshooting.md:35 references/token.md:15 references/token.md:16 references/token.md:17 references/token.md:18 references/token.md:15 references/token.md:16 references/token.md:17 references/token.md:18 references/trenches.md:33 references/trenches.md:34 references/trenches.md:35 references/trenches.md:36 references/trenches.md:33 references/trenches.md:34 references/trenches.md:35 references/trenches.md:36 references/ws.md:13 references/ws.md:13 SKILL.md:17 SKILL.md:21
π Env variables (30)
_shared/payment-notifications.md:115 references/market-ws-protocol.md:40 references/market-ws-protocol.md:52 references/market-ws-protocol.md:56 references/market-ws-protocol.md:64 references/market-ws-protocol.md:68 references/market-ws-protocol.md:72 references/market-ws-protocol.md:75 references/signal-ws-protocol.md:40 references/signal-ws-protocol.md:52 references/signal-ws-protocol.md:56 references/signal-ws-protocol.md:64 references/signal-ws-protocol.md:68 references/signal-ws-protocol.md:72 references/signal-ws-protocol.md:75 references/social-troubleshooting.md:35 references/token-ws-protocol.md:39 references/token-ws-protocol.md:51 references/token-ws-protocol.md:55 references/token-ws-protocol.md:63 references/token-ws-protocol.md:67 references/token-ws-protocol.md:71 references/token-ws-protocol.md:74 references/trenches-ws-protocol.md:40 references/trenches-ws-protocol.md:52 references/trenches-ws-protocol.md:56 references/trenches-ws-protocol.md:64 references/trenches-ws-protocol.md:68 references/trenches-ws-protocol.md:72 references/trenches-ws-protocol.md:75
Audited by: claude
Jul 10, 2026, 12:24 AM
Most static findings are markdown formatting, placeholder credential examples, official OKX URLs, and fixed workflow hint paths. Confirmed risks are limited to parent-directory shared-file references, a remote installer fallback, and payment-default persistence that needs clear consent. No prompt injection attempt was found in the reviewed files.
30
Files scanned
4,763
Lines analyzed
8
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Remote Installer Execution Fallback
The preflight fallback instructs the agent to download install.sh and run it when onchainos is missing. This creates remote code execution and supply-chain risk even though checksum verification is mentioned.
Line 16 explicitly directs a download-and-run installer flow; line 12 says preflight updates the binary and skill checkouts. Checksum verification lowers but does not remove supply-chain risk.
Medium
_shared/payment-notifications.md:76-80_shared/payment-notifications.md:107-110_shared/payment-notifications.md:115-123
Payment Default Persistence Requires Strong Consent
The payment flow persists a selected asset as the user default and reruns the original command. Future matching paid API calls can be auto-signed after tier confirmation.
The file clearly requires user confirmation and cancellation options. It still changes persisted payment defaults and enables future automatic signing for the confirmed tier.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Path traversal sequence
> Read `../okx-agentic-wallet/_shared/preflight.md`. If that file does not exist, read `_shared/pref
The instruction tells the agent to read a parent-directory path outside this skill package. The path is fixed and likely intended, but it crosses the skill boundary and should remain a filesystem risk.
High
Path traversal sequence
> Full chain list: `../okx-agentic-wallet/_shared/chain-support.md`. If that file does not exist, re
The instruction tells the agent to read a parent-directory path outside this skill package. The path is fixed and likely intended, but it crosses the skill boundary and should remain a filesystem risk.
Risk Factors
βοΈ External commands (15)
π Filesystem access (40)
_shared/payment-notifications.md:129 _shared/payment-notifications.md:129 references/market.md:15 references/market.md:16 references/market.md:17 references/market.md:15 references/market.md:16 references/market.md:17 references/signal.md:15 references/signal.md:16 references/signal.md:17 references/signal.md:18 references/signal.md:19 references/signal.md:15 references/signal.md:16 references/signal.md:17 references/signal.md:18 references/signal.md:19 references/social-troubleshooting.md:35 references/social-troubleshooting.md:35 references/token.md:15 references/token.md:16 references/token.md:17 references/token.md:18 references/token.md:15 references/token.md:16 references/token.md:17 references/token.md:18 references/trenches.md:33 references/trenches.md:34 references/trenches.md:35 references/trenches.md:36 references/trenches.md:33 references/trenches.md:34 references/trenches.md:35 references/trenches.md:36 references/ws.md:13 references/ws.md:13 SKILL.md:17 SKILL.md:21
π Env variables (30)
_shared/payment-notifications.md:115 references/market-ws-protocol.md:40 references/market-ws-protocol.md:52 references/market-ws-protocol.md:56 references/market-ws-protocol.md:64 references/market-ws-protocol.md:68 references/market-ws-protocol.md:72 references/market-ws-protocol.md:75 references/signal-ws-protocol.md:40 references/signal-ws-protocol.md:52 references/signal-ws-protocol.md:56 references/signal-ws-protocol.md:64 references/signal-ws-protocol.md:68 references/signal-ws-protocol.md:72 references/signal-ws-protocol.md:75 references/social-troubleshooting.md:35 references/token-ws-protocol.md:39 references/token-ws-protocol.md:51 references/token-ws-protocol.md:55 references/token-ws-protocol.md:63 references/token-ws-protocol.md:67 references/token-ws-protocol.md:71 references/token-ws-protocol.md:74 references/trenches-ws-protocol.md:40 references/trenches-ws-protocol.md:52 references/trenches-ws-protocol.md:56 references/trenches-ws-protocol.md:64 references/trenches-ws-protocol.md:68 references/trenches-ws-protocol.md:72 references/trenches-ws-protocol.md:75
Audited by: codex