📦
Audit History
okx-guide - 2 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 2 Latest
Jul 19, 2026, 10:59 AM
Most URL, secret-name, and backtick detections are documentation-only false positives. However, the skill obeys arbitrary preflight output and follows files outside its audited directory. It also loads hidden home workflows and can trigger plugin installation, creating critical supply-chain risk.
9
Files scanned
756
Lines analyzed
23
Review items
0
False positives ignored
Confirmed security concerns (2)
Critical
Untrusted Preflight Output Controls Agent Actions
The skill runs onchainos preflight and requires the agent to do exactly what data.action says. It also downloads and runs an installer when missing.
The mandatory text explicitly delegates agent control to command output and bootstraps executable installation. No action allowlist or user approval is required.
High
Automatic Third-Party Plugin Installation Route
Selecting Polymarket invokes another skill that routes to or installs polymarket-plugin. The installation occurs through an unaudited dependency path.
The routing table explicitly states that the invoked skill installs the plugin. This report does not include that plugin or an approval requirement.
Capability review items (17)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Path traversal sequence
- `loggedIn: false` → user is not logged in. Do **not** query identity. Hand off to the existing wal
The flow loads ../../okx-agentic-wallet/SKILL.md outside the audited skill directory and follows its login instructions. That external content is not covered by this audit.
High
Hidden file in home directory
- If the user came from picking the **Daily brief** option (option `4` in Variant A / option `3` in
The instruction loads and follows a hidden home-directory workflow after login. A modified local workflow can provide unreviewed agent instructions.
High
Hidden file in home directory
- If the user came from picking any other **workflow pick** while logged out: automatically load the
The instruction dynamically loads a corresponding workflow from ~/.onchainos and follows it. The target content is outside the audited package.
High
Hidden file access
- If the user came from picking the **Daily brief** option (option `4` in Variant A / option `3` in
The agent is explicitly told to access and follow hidden local workflow content. This creates an unreviewed instruction boundary.
High
Hidden file access
- If the user came from picking any other **workflow pick** while logged out: automatically load the
The workflow path is in a hidden home directory and its content is followed automatically. No integrity check or confirmation is required.
High
Path traversal sequence
- **Status column** — read the agent's `status` field and map it per [`../../okx-ai/references/ident
The flow reads status rules from ../../okx-ai outside the audited skill directory. Changes in that external file can alter agent behavior.
High
Path traversal sequence
Each "not registered yet" line on the home invites the user to register that role. If the user repli
The agent loads an external identity registration playbook and follows it to completion. That unaudited dependency can initiate consequential registration actions.
High
Path traversal sequence
| `1` (User) | `Registering your User identity, hang tight... ⏳` | [`../../okx-ai/references/identit
Selecting User loads and follows an identity registration file outside the audited directory. The external playbook can perform consequential actions.
High
Path traversal sequence
| `2` (ASP) | `Registering your ASP identity, hang tight... ⏳` | [`../../okx-ai/references/identity-
Selecting ASP loads and follows an identity registration file outside the audited directory. Its instructions are not reviewed in this report.
High
Path traversal sequence
| `3` (Evaluator) | `Registering your Evaluator identity, hang tight... ⏳` | [`../../okx-ai/referenc
Selecting Evaluator loads an external registration flow that can continue into staking. This consequential dependency is outside the audited package.
High
Hidden file in home directory
| `3` | B | ☕ Daily on-chain brief | **Yes** (logged-out → Login Method Choice → resume) | `~/.oncha
The menu routes a selection to a hidden daily-brief workflow in the home directory. That target is outside this audited skill.
High
Hidden file in home directory
| `4` | A | ☕ Daily on-chain brief | **Yes** (logged-out → Login Method Choice → resume) | `~/.oncha
The alternate menu variant routes to the same hidden home workflow. Its content can change independently of this package.
High
Hidden file in home directory
- **Logged-in user**: load `~/.onchainos/workflows/daily-brief.md` directly and follow it.
Logged-in users cause the agent to load and follow ~/.onchainos/workflows/daily-brief.md directly. No content validation or approval is required.
High
Hidden file access
| `3` | B | ☕ Daily on-chain brief | **Yes** (logged-out → Login Method Choice → resume) | `~/.oncha
This routing target accesses hidden local workflow content. The selected file is not part of the audited package.
High
Hidden file access
| `4` | A | ☕ Daily on-chain brief | **Yes** (logged-out → Login Method Choice → resume) | `~/.oncha
This alternate menu path accesses the same hidden workflow. The agent later follows its unaudited instructions.
High
Hidden file access
- **Logged-in user**: load `~/.onchainos/workflows/daily-brief.md` directly and follow it.
The instruction explicitly reads and follows a hidden local Markdown file. A compromised workflow can control subsequent agent actions.
High
Path traversal sequence
**MUST**: Run the shared preflight **only for the onboarding flow** (§1 → `references/how-to-play.md
The mandatory preflight first reads ../okx-agentic-wallet/_shared/preflight.md outside this skill. That external file can change the instructions executed during onboarding.
Risk Factors
📁 Filesystem access (17)
references/ai-guide.md:47 references/how-to-play.md:113 references/how-to-play.md:114 references/how-to-play.md:113 references/how-to-play.md:114 references/registered-home.md:12 references/registered-home.md:49 references/unregistered-role-selection.md:19 references/unregistered-role-selection.md:20 references/unregistered-role-selection.md:21 references/welcome.md:165 references/welcome.md:166 references/welcome.md:189 references/welcome.md:165 references/welcome.md:166 references/welcome.md:189 SKILL.md:26
🌐 Network access (5)
⚙️ External commands (9)
🔑 Env variables (2)
Audited by: codex
Jul 10, 2026, 12:35 AM
The review confirms real boundary risks from sibling-package references and hidden home-directory workflow loading. Most other alerts are false positives from Markdown code spans, official user-facing URLs, and protective credential warnings. No prompt-injection text was found in the reviewed files, but the shared preflight also adds installer and update risk.
9
Files scanned
747
Lines analyzed
22
Review items
0
False positives ignored
Confirmed security concerns (1)
High
Automatic Installer and Update Flow
The shared preflight can update binaries and skill checkouts, run a forced upgrade command, and download installation scripts when the CLI is missing. A community skill should not trigger tool installation or updates without explicit marketplace-controlled confirmation.
The file directly instructs running preflight and fallback installer behavior, including upgrade and install script steps. The risk is contextual because it depends on external onchainos tooling, but the intent is clear.
Capability review items (17)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Path traversal sequence
- `loggedIn: false` → user is not logged in. Do **not** query identity. Hand off to the existing wal
The skill directs the agent to read ../../okx-agentic-wallet/SKILL.md, which escapes the skill package boundary. Loading sibling skill content can import unreviewed instructions.
High
Hidden file in home directory
- If the user came from picking the **Daily brief** option (option `4` in Variant A / option `3` in
The flow auto-loads ~/.onchainos/workflows/daily-brief.md after login. Reading executable prompt content from a hidden home directory is a real boundary and prompt-injection risk.
High
Hidden file in home directory
- If the user came from picking any other **workflow pick** while logged out: automatically load the
The flow auto-loads ~/.onchainos/workflows/<file>.md based on a workflow pick. The dynamic hidden-home path can import local prompt content outside the reviewed package.
High
Path traversal sequence
- **Status column** — read the agent's `status` field and map it per [`../../okx-ai/references/ident
The status mapping relies on ../../okx-ai/references/identity-invariants.md outside this skill. Cross-package reads can import instructions that were not reviewed with this package.
High
Path traversal sequence
Each "not registered yet" line on the home invites the user to register that role. If the user repli
The registration path loads ../../okx-ai/references/identity-register.md outside the skill boundary. That delegates control to external prompt content from a sibling package.
High
Path traversal sequence
| `1` (User) | `Registering your User identity, hang tight... ⏳` | [`../../okx-ai/references/identit
Selecting the User role loads ../../okx-ai/references/identity-register.md outside this package. That is a real package-boundary escape even if the target is intentional.
High
Path traversal sequence
| `2` (ASP) | `Registering your ASP identity, hang tight... ⏳` | [`../../okx-ai/references/identity-
Selecting the ASP role loads the same ../../okx-ai registration playbook outside this package. The skill depends on unbundled sibling instructions.
High
Path traversal sequence
| `3` (Evaluator) | `Registering your Evaluator identity, hang tight... ⏳` | [`../../okx-ai/referenc
Selecting the Evaluator role loads the same ../../okx-ai registration playbook outside this package. This crosses the reviewed skill boundary for a privileged registration flow.
High
Hidden file in home directory
| `3` | B | ☕ Daily on-chain brief | **Yes** (logged-out → Login Method Choice → resume) | `~/.oncha
The menu routes a logged-in daily brief pick to ~/.onchainos/workflows/daily-brief.md. Loading hidden-home prompt files is outside the audited skill content.
High
Hidden file in home directory
| `4` | A | ☕ Daily on-chain brief | **Yes** (logged-out → Login Method Choice → resume) | `~/.oncha
The alternate menu variant also routes daily brief to ~/.onchainos/workflows/daily-brief.md. The target file is local hidden-home content and is not packaged here.
High
Hidden file in home directory
- **Logged-in user**: load `~/.onchainos/workflows/daily-brief.md` directly and follow it.
The logged-in branch directly loads ~/.onchainos/workflows/daily-brief.md. That creates a real hidden-home file access and prompt-import risk.
High
Path traversal sequence
**MUST**: Run the shared preflight **only for the onboarding flow** (§1 → `references/how-to-play.md
The preflight instruction first tries ../okx-agentic-wallet/_shared/preflight.md, which escapes this skill directory. Cross-skill reads can load unreviewed instructions before the user flow begins.
Medium
Hidden file access
- If the user came from picking the **Daily brief** option (option `4` in Variant A / option `3` in
The same line instructs the agent to load a hidden-home workflow file. That is legitimate product behavior, but it still reads unreviewed local prompt content.
Medium
Hidden file access
- If the user came from picking any other **workflow pick** while logged out: automatically load the
The same line instructs the agent to load a hidden-home workflow file selected from a route. The reviewed skill does not contain or validate the target file.
Medium
Hidden file access
| `3` | B | ☕ Daily on-chain brief | **Yes** (logged-out → Login Method Choice → resume) | `~/.oncha
The line instructs loading the hidden daily-brief workflow from the user home directory. This is intentional behavior but still imports unreviewed local content.
Medium
Hidden file access
| `4` | A | ☕ Daily on-chain brief | **Yes** (logged-out → Login Method Choice → resume) | `~/.oncha
The line repeats the hidden daily-brief workflow load for another menu variant. It is a real hidden file read outside the marketplace-reviewed package.
Medium
Hidden file access
- **Logged-in user**: load `~/.onchainos/workflows/daily-brief.md` directly and follow it.
The logged-in branch explicitly loads a hidden workflow file from ~/.onchainos. That file is not included in this skill audit.
Risk Factors
📁 Filesystem access (17)
references/ai-guide.md:47 references/how-to-play.md:113 references/how-to-play.md:114 references/how-to-play.md:113 references/how-to-play.md:114 references/registered-home.md:12 references/registered-home.md:49 references/unregistered-role-selection.md:19 references/unregistered-role-selection.md:20 references/unregistered-role-selection.md:21 references/welcome.md:165 references/welcome.md:166 references/welcome.md:189 references/welcome.md:165 references/welcome.md:166 references/welcome.md:189 SKILL.md:17
🌐 Network access (4)
⚙️ External commands (9)
🔑 Env variables (2)
Audited by: codex