技能 okx-agentic-wallet
📦

okx-agentic-wallet

v4.6.6 內容修訂 r1 高風險 📁 檔案系統存取⚙️ 外部命令🌐 網路存取

Manage OKX Wallets and On-Chain Transactions

Managing wallets across chains requires careful address checks, fee review, and transaction tracking. This skill guides Onchain OS CLI workflows for holdings, transfers, swaps, bridges, and security checks.

支援: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 差

使用我的智慧代理安裝

將此請求複製給你的智慧代理,其中包含權威 Skill 頁面和清單。

智能體請求
Review the Skillstore skill "okx-agentic-wallet" from https://skillstore.io/skills/okx-okx-agentic-wallet.md and its manifest at https://skillstore.io/api/skills/okx-okx-agentic-wallet/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫,並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時,請使用這些連結。

測試它

正在使用「okx-agentic-wallet」。 Show my holdings without changing anything.

預期結果:

  • Illustrative result: Active account: Primary.
  • Ethereum holdings: 0.20 ETH and 150 USDC.
  • No transactions were submitted.

正在使用「okx-agentic-wallet」。 Compare bridge options but do not send funds.

預期結果:

  • Illustrative comparison: Route A estimates 99.50 USDC received, with a 0.50 USDC bridge fee.
  • Route B estimates 99.20 USDC received, with a 0.80 USDC bridge fee.
  • Source-chain gas is additional. Quotes can change. No bridge transaction was submitted.

正在使用「okx-agentic-wallet」。 The token security scan failed. What happens next?

預期結果:

  • Token verification is unavailable. No safety conclusion can be drawn.
  • Pause the trade and retry the scan before authorizing execution.

安全審計

高風險
v1 • 2026/10/28 開啟版本化報告

All 116 static matches are false positives for the reported patterns: documentation formatting, wallet identifiers, protective secret references, and legitimate paths or URLs. Semantic review found failed-scan continuation, conflicting swap-block rules, returned-command execution without specified validation, and an unpinned preflight installer. No evidence found of credential exfiltration or audit-directed prompt injection; external CLI and backend implementations were not verified.

32
已掃描檔案
3,264
分析行數
0
複核項目
0
已忽略的誤報

已確認的安全問題 (4)

高
Swap Security Scans Fail Open
Swap token-scan failures automatically continue with a warning, and unsupported scan chains do not block. Trading can proceed without completed token-risk verification.
The swap exception explicitly removes the general retry-or-consent pause after scan failure. This creates a verification gap, not evidence of malicious intent.
高
Conflicting Rules Permit Blocked Swap Overrides
The swap flow says blocked routes must not broadcast, but later rules say BLOCK requires an explicit override, including blacklisted addresses. This weakens mandatory stops.
Directly conflicting instructions distinguish neither overridable warnings nor immutable blocks. An agent can interpret later override guidance as authorization to trade blocked assets.
高
Returned Command Strings Cross the Execution Boundary
The skill follows returned next commands and uses returned bridge-status commands verbatim. It specifies no command allowlist or argument validation before execution.
The execution instructions directly trust returned command strings despite declaring CLI output untrusted. Exploitation depends on influencing those fields; no injected payload was found.
中
Mandatory Preflight Runs an Unpinned Installer
The required preflight delegates to an automatically approved npx installer without a package version. Registry-delivered code runs before wallet operations without separate installation consent.
The cited line mandates the linked preflight, which runs npx -y @okxweb3/onchainos-installer. Its skill-version argument does not pin the installer package.
審計單位: codex
分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據,不判斷該 Skill 是否安全。

開啟版本化報告
安全評估

複製報告連結

https://skillstore.io/skills/okx-okx-agentic-wallet/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/okx-okx-agentic-wallet/security.svg)](https://skillstore.io/skills/okx-okx-agentic-wallet?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/okx-okx-agentic-wallet?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/okx-okx-agentic-wallet/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/okx-okx-agentic-wallet.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
學術引用 (APA · BibTeX · CFF)

APA 引用

okx. (2026). okx-agentic-wallet security audit report (audit version 1) [Author version 4.6.6]. Skillstore. https://skillstore.io/skills/okx-okx-agentic-wallet/audits/1

BibTeX 引用

@techreport{okx-okx-okx-agentic-wallet-2026, author = {okx}, title = {okx-agentic-wallet security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/okx-okx-agentic-wallet/audits/1}, note = {Author version 4.6.6} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "okx-agentic-wallet security audit report (audit version 1)" version: "4.6.6" type: report authors: - name: "okx" date-released: "2026-10-28" url: "https://skillstore.io/skills/okx-okx-agentic-wallet/audits/1" identifiers: - type: other value: "skillstore:okx-okx-agentic-wallet:audit:1" description: "Skillstore immutable audit report identifier"

比較變體

2 個可安裝變體

每位作者的技能都保留為獨立的可安裝項目。推薦變體依 Skillstore 證據排序。

為何此變體排名第一

Skillstore 使用量較高

internet-court-okx-agentic-wallet

Skillstore 評分 38
證據置信度 中
Skillstore 使用量 10
已更新

2026-09-09

okx 目前

okx-okx-agentic-wallet

Skillstore 評分 38
證據置信度 中
Skillstore 使用量 未知
已更新

2026-10-28

Skillstore 評分

評分依據 證據置信度: 中
45
架構
100
可維護性
87
內容
65
社群
100
規範符合度

你可以打造什麼

Review Personal Wallet Holdings

Inspect account balances, receive addresses, and transaction history without requesting transfers or disclosing credentials.

Compare Swap and Bridge Routes

Review token identities, expected proceeds, fees, and route risks before deciding whether to authorize a transaction.

Inspect Transaction and Approval Risks

Check contract interactions, inspect token allowances, and prepare revocations with simulation and explicit confirmation.

試試這些提示

Check Wallet Balances
Show my current wallet account and token balances. Use read-only queries. Do not transfer funds or reveal credentials.
Review a Token Transfer
Prepare a transfer of [amount] [token] on [chain] to [full recipient address]. Show fees and checks. Wait for confirmation before sending.
Compare Bridge Routes
Compare routes for [amount] [token] from [source chain] to [destination chain]. Show fees and minimum receipts. Do not execute.
Audit Approvals Before Revocation
Inspect token approvals for [public address] on [chain]. Explain flagged spenders and prepare bounded revocations. Stop if scans fail. Confirm each write separately.

最佳實務

  • Use a limited-balance wallet and configure spending limits and destination allowlists through the official portal before authorizing transactions.
  • Verify full addresses, chain, token identity, fees, and slippage against fresh CLI output before confirming each write.
  • Pause when scans fail or return BLOCK. Validate returned commands against documented syntax instead of executing arbitrary response strings.

避免

  • Sharing seed phrases, private keys, API credentials, or session tokens in the conversation.
  • Treating transaction broadcast, request acceptance, or a funding notification as final settlement or renewed transfer authorization.
  • Using force flags on the first attempt, bypassing blocked verdicts, or assuming a failed scan means an asset is safe.

常見問題

Which AI tools can use this skill?
The report lists Claude, Codex, and Claude Code. Actual execution also requires compatible command access and the external Onchain OS CLI.
Does every operation require wallet login?
No. Public-address portfolio queries and security checks can work without login. Wallet writes and limit orders require an authenticated account.
Can the agent export my seed phrase?
No. Export is a user action in the official wallet application or extension. Never share the resulting phrase with the agent.
Will it ask before sending funds?
The main rules require explicit confirmation before writes. Automated modes require prior opt-in. Conflicting swap-block instructions remain an audit concern.
Are swaps and limit orders available on every chain?
No. Support varies by command and backend. Limit orders list Ethereum, BSC, X Layer, Solana, Base, and Arbitrum.
Does a completed security scan guarantee safety?
No. Results cover only the checks performed. Failed scans provide no verification, and some documented swap paths continue with warnings.

okx 的更多技能

查看全部
查看全部