此報告尚無所請求語言的翻譯，目前顯示規範英文報告。

版本化安全評估

報告編號: SA-68AD52C8

10/28/2026, 2:47:55 PM

okx-agentic-wallet 安全評估 v1

Skill 安全認證報告

審計紀錄

掃描器版本 3.0.0 稽核模型: codex 最新發佈的報告

技能名稱: okx-agentic-wallet
版本: v4.6.6
維護者: okx
來源: github.com/okx/onchainos-skills/tree/35a8c41cc6516844ae7dbedf02616bf4ea97d6ed/skills/okx-agentic-wallet
涵蓋範圍: 32 已掃描檔案 · 3,264 分析行數
策略版本: skillstore-security-audit-policy-v1

已確認問題的最高嚴重性

高

有 4 個已確認的安全問題需要處理。

安裝情境

請查看目前的 Skill 詳情頁

本頁僅彙整報告證據。Skill 詳情頁提供權威安裝建議。

開啟目前的 Skill 詳情頁

本報告不會阻止或授權 manifest 或 ZIP。

All 116 static matches are false positives for the reported patterns: documentation formatting, wallet identifiers, protective secret references, and legitimate paths or URLs. Semantic review found failed-scan continuation, conflicting swap-block rules, returned-command execution without specified validation, and an unpinned preflight installer. No evidence found of credential exfiltration or audit-directed prompt injection; external CLI and backend implementations were not verified.

報告位置

證據鏈

證據從來源綁定延伸至安裝契約。證據可用於驗證，但並非安全保證。

來源

已綁定 commit 與路徑
構件

已綁定內容與 tree hash
稽核

已完成
安裝契約

開啟 manifest 進行驗證
開啟 manifest

觀察到的能力

「已觀察到」表示本報告記錄了支持證據；「未記錄」不證明該能力不存在。

包含腳本

可能執行 Skill 隨附的程式碼。

此次稽核未記錄

網路存取

可能連線至外部服務。

在 5 個證據位置觀察到

檔案系統存取

可能讀取或寫入本機檔案。

在 4 個證據位置觀察到

環境變數

可能讀取處理程序環境中的值。

此次稽核未記錄

外部命令

可能叫用 Skill 以外的命令或程式。

在 24 個證據位置觀察到

風險問題

已確認的安全問題與仍需審核的項目分開顯示。

已確認的安全問題 (4)

RISK-001 高

references/security.md:35

Swap Security Scans Fail Open

Swap token-scan failures automatically continue with a warning, and unsupported scan chains do not block. Trading can proceed without completed token-risk verification.

The swap exception explicitly removes the general retry-or-consent pause after scan failure. This creates a verification gap, not evidence of malicious intent.

RISK-002 高

references/swap.md:58 references/swap.md:106-120 SKILL.md:99-101

Conflicting Rules Permit Blocked Swap Overrides

The swap flow says blocked routes must not broadcast, but later rules say BLOCK requires an explicit override, including blacklisted addresses. This weakens mandatory stops.

Directly conflicting instructions distinguish neither overridable warnings nor immutable blocks. An agent can interpret later override guidance as authorization to trade blocked assets.

RISK-003 高

SKILL.md:80-86 references/bridge.md:82-89 references/bridge-cli-reference.md:92

Returned Command Strings Cross the Execution Boundary

The skill follows returned next commands and uses returned bridge-status commands verbatim. It specifies no command allowlist or argument validation before execution.

The execution instructions directly trust returned command strings despite declaring CLI output untrusted. Exploitation depends on influencing those fields; no injected payload was found.

RISK-004 中

SKILL.md:45-47

Mandatory Preflight Runs an Unpinned Installer

The required preflight delegates to an automatically approved npx installer without a package version. Registry-delivered code runs before wallet operations without separate installation consent.

The cited line mandates the linked preflight, which runs npx -y @okxweb3/onchainos-installer. Its skill-version argument does not pin the installer package.

補救措施

本次稽核記錄了建議的修復措施。實施這些措施是維護者的責任。

FIX-001
高
Swap token scanning continues automatically when verification fails or a chain is unsupported.

Pause execution until scanning succeeds, or require separate informed consent for each unverified trade. Never treat unavailable results as approval.
FIX-002
高
Swap rules allow explicit overrides of BLOCK verdicts despite mandatory stop rules elsewhere.

Make BLOCK non-overridable throughout the skill. Reserve warning confirmations for WARN results and document one consistent policy.
FIX-003
高
Returned next-step command strings are promoted to executable instructions without a defined validation boundary.

Use allowlisted structured actions and validated argument arrays. Reject shell syntax, unknown subcommands, and changes to the confirmed wallet, destination, or amount.
FIX-004
中
Mandatory preflight runs an automatically approved registry installer without pinning its package version.

Pin a reviewed installer version and verify package provenance. Require installation consent and prefer an already verified local CLI.

專家證據

不可變主體身分、掃描器中繼資料、已排除的相符項目和原始碼層級證據。

Artifact 主體

Marketplace 提交: 68ad52c83048aa55fba46a90f4f6c6d9922a47b0
內容雜湊: d94867982252ae4954c3cadbb836faffa56517bb8baa654eceb19b93a86faeb1
目錄樹雜湊: b5ea83c382a060f77e77cb39b0dd2c8aad25bf929156fc017bcb3662881430fe
Skill 路徑: skills/okx/okx-agentic-wallet
稽核承載資料雜湊: 1e960ab92cf0df916ca8bacfd8e4a654

分析中繼資料

稽核模型: codex

分析狀態: 已完成

範圍僅限於已記錄的檔案、行數、方法和證據；本報告不聲稱進行了執行階段或沙箱執行。

驗證與匯出

JSON 報告已簽署稽核證明 CITATION.cff SARIF 2.1.0 已簽署安裝清單來源

manifest 和 lockfile 將安裝 artifact 綁定到加密雜湊。該完整性聲明獨立於安全評估。

稽核證明: active