📦

審計紀錄

okx-agentic-wallet - 1 審計

2026年10月28日下午02:47

All 116 static matches are false positives for the reported patterns: documentation formatting, wallet identifiers, protective secret references, and legitimate paths or URLs. Semantic review found failed-scan continuation, conflicting swap-block rules, returned-command execution without specified validation, and an unpinned preflight installer. No evidence found of credential exfiltration or audit-directed prompt injection; external CLI and backend implementations were not verified.

已掃描檔案

3,264

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (4)

高

references/security.md:35

Swap Security Scans Fail Open

Swap token-scan failures automatically continue with a warning, and unsupported scan chains do not block. Trading can proceed without completed token-risk verification.

The swap exception explicitly removes the general retry-or-consent pause after scan failure. This creates a verification gap, not evidence of malicious intent.

高

references/swap.md:58 references/swap.md:106-120 SKILL.md:99-101

Conflicting Rules Permit Blocked Swap Overrides

The swap flow says blocked routes must not broadcast, but later rules say BLOCK requires an explicit override, including blacklisted addresses. This weakens mandatory stops.

Directly conflicting instructions distinguish neither overridable warnings nor immutable blocks. An agent can interpret later override guidance as authorization to trade blocked assets.

高

SKILL.md:80-86 references/bridge.md:82-89 references/bridge-cli-reference.md:92

Returned Command Strings Cross the Execution Boundary

The skill follows returned next commands and uses returned bridge-status commands verbatim. It specifies no command allowlist or argument validation before execution.

The execution instructions directly trust returned command strings despite declaring CLI output untrusted. Exploitation depends on influencing those fields; no injected payload was found.

中

SKILL.md:45-47

Mandatory Preflight Runs an Unpinned Installer

The required preflight delegates to an automatically approved npx installer without a package version. Registry-delivered code runs before wallet operations without separate installation consent.

The cited line mandates the linked preflight, which runs npx -y @okxweb3/onchainos-installer. Its skill-version argument does not pin the installer package.

審計單位: codex

← 回到技能

審計紀錄

已確認的安全問題 (4)

風險因素