技能 okx-dapp-discovery

📦

okx-dapp-discovery

Name: okx-dapp-discovery
Author: okx

v4.4.10 內容修訂 r1 中風險 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取

Discover and Route OKX DApp Plugins

Choosing the correct DeFi plugin can be difficult across protocols and intent types. This skill identifies supported DApps, requests installation consent, and resumes the original task.

支援: Claude Codex Code(CC)

⚠️ 50 差

Maintain this Skill? Claim it ⚠️ 50 差

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "okx-dapp-discovery" from https://skillstore.io/skills/okx-okx-dapp-discovery.md and its manifest at https://skillstore.io/api/skills/okx-okx-dapp-discovery/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/okx-okx-dapp-discovery.md 已簽名 manifest GET /api/skills/okx-okx-dapp-discovery/manifest 已簽名 lockfile GET /api/skills/okx-okx-dapp-discovery/lockfile

測試它

正在使用「okx-dapp-discovery」。 What DApps can I use for lending?

預期結果:

Supported lending options include Aave V3, Compound V3, Kamino Lend, and Morpho V1 Optimizer. Which protocol matches your goal?

正在使用「okx-dapp-discovery」。 Deposit 100 USDC into Aave.

預期結果:

This request maps to the Aave V3 plugin. I will ask for installation approval before continuing if the plugin is missing.

正在使用「okx-dapp-discovery」。 Compare Lido and ether.fi.

預期結果:

I can discuss their tradeoffs or set up either plugin. No plugin will be installed until you choose.

安全審計

中風險

v1 • 2026/8/20 開啟版本化報告

Most static findings are Markdown formatting, DeFi terminology, or protective consent guidance rather than dangerous behavior. Confirmed behavior includes `npx` execution, global plugin installation, and a user-approved GitHub catalog request. The mutable plugin source creates a medium supply-chain risk despite explicit consent and fetched-content safeguards.

已掃描檔案

620

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (1)

中

SKILL.md:196-214

Mutable Global Plugin Supply Chain

The workflow globally installs plugin documents from a registry reference without an immutable commit, version, or integrity digest. It then loads those remote instructions into the agent context.

The install command uses the mutable `okx/plugin-store` reference with `--global`, and no commit or digest verification is specified. Consent and fetched-content guards reduce impact.

能力複核項目 (7)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

中

SKILL.md:177-192

Ruby/shell backtick execution

```bash

The Bash block runs `npx skills list` automatically to inspect installed plugins. `npx` can execute external package code and may fetch it when unavailable locally.

中

SKILL.md:202-207

Ruby/shell backtick execution

```bash

The Bash block executes `npx skills add` with global installation after user confirmation. This runs external tooling and modifies the global skills directory.

中

SKILL.md:238

Ruby/shell backtick execution

- **Failure mode:** if `npx skills add` fails (network/registry), tell the user: "I couldn't install

The failure guidance gives the user an executable `npx skills add` command that performs a global install. User initiation limits the risk, but the external command is real.

中

SKILL.md:304-307

Ruby/shell backtick execution

```bash

The Bash block runs a curl and Python pipeline against GitHub after user approval. It is read-only, but it still executes external commands and processes remote data.

中

SKILL.md:178

Shell command substitution

SKILLS_LIST=$(npx skills list 2>/dev/null)

The shell assignment executes `npx skills list` through command substitution. Its arguments are fixed, but it invokes external package code before install consent.

中

SKILL.md:177-192

Template literal with command substitution

```bash

The fenced Bash block contains active shell command substitution around `npx skills list`. This is executable installation-state discovery, not a template literal.

低

SKILL.md:305

Hardcoded URL

curl -fsSL --max-time 5 "https://api.github.com/repos/okx/plugin-store/contents/skills" 2>/dev/null

The catalog lookup sends a read-only GET to the hardcoded GitHub API endpoint after explicit approval. The request is intentional and bounded, but network access is real.

風險因素

⚙️ 外部命令 (50)

🌐 網路存取 (2)

SKILL.md:12 SKILL.md:305

📁 檔案系統存取 (12)

SKILL.md:222 SKILL.md:224 SKILL.md:229 SKILL.md:173 SKILL.md:209 SKILL.md:222 SKILL.md:224 SKILL.md:229 SKILL.md:178 SKILL.md:305 SKILL.md:306 SKILL.md:224

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/okx-okx-dapp-discovery/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/okx-okx-dapp-discovery/security.svg)](https://skillstore.io/skills/okx-okx-dapp-discovery?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/okx-okx-dapp-discovery?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/okx-okx-dapp-discovery/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/okx-okx-dapp-discovery.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

okx. (2026). okx-dapp-discovery security audit report (audit version 1) [Author version 4.4.10]. Skillstore. https://skillstore.io/skills/okx-okx-dapp-discovery/audits/1

BibTeX 引用

@techreport{okx-okx-okx-dapp-discovery-2026,
  author = {okx},
  title = {okx-dapp-discovery security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/okx-okx-dapp-discovery/audits/1},
  note = {Author version 4.4.10}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "okx-dapp-discovery security audit report (audit version 1)"
version: "4.4.10"
type: report
authors:
  - name: "okx"
date-released: "2026-08-20"
url: "https://skillstore.io/skills/okx-okx-dapp-discovery/audits/1"
identifiers:
  - type: other
    value: "skillstore:okx-okx-dapp-discovery:audit:1"
    description: "Skillstore immutable audit report identifier"

比較變體

2 個可安裝變體

每位作者的技能都保留為獨立的可安裝項目。推薦變體依 Skillstore 證據排序。

為何此變體排名第一

Skillstore 評分最高

作者 / 來源 Skillstore 評分證據置信度 Skillstore 使用量已更新

okx 推薦目前

okx-okx-dapp-discovery

Skillstore 評分 50

證據置信度中

Skillstore 使用量 8

已更新

2026-09-09

internet-court

internet-court-okx-dapp-discovery

Skillstore 評分 38

證據置信度中

Skillstore 使用量 9

已更新

2026-09-09

Skillstore 評分

評分依據證據置信度: 中

架構

100

可維護性

內容

社群

規範符合度

你可以打造什麼

Find a Supported DApp

Review the available lending, trading, staking, prediction, and liquidity protocols before choosing one.

Route a Protocol Action

Map a named protocol action or native token request to the correct plugin and request installation approval.

Resolve Multilingual Intent

Interpret English or Chinese DApp requests while preserving protocol-specific routing and clarification rules.

試試這些提示

List Supported DApps

Show the supported DApps by category and explain which option fits my goal: [goal].

Route a Direct Action

I want to [action] [amount and token] on [DApp]. Select the correct plugin and ask before installing it.

Compare Supported Protocols

Compare [DApp A] and [DApp B] for [goal]. Do not install anything until I choose.

Handle an Unknown DApp

Check whether [DApp] is supported. Show close alternatives and offer a catalog lookup without installing anything automatically.

最佳實務

Name the DApp, action, token, and amount when requesting protocol routing.
Review every plugin installation prompt and transaction approval separately.
Use comparison prompts before installation when multiple protocols may fit.

避免

Do not paste private keys, seed phrases, API keys, passwords, or session tokens.
Do not treat plugin installation as approval for a blockchain transaction.
Do not expect unsupported protocol variants to map to the closest plugin automatically.