技能 okx-guide

📦

okx-guide

Name: okx-guide
Author: okx

v4.4.10 內容修訂 r1 高風險 ⚙️ 外部命令📁 檔案系統存取🌐 網路存取

Explore Onchain OS and OKX.AI

New users need clear paths through Onchain OS, OKX.AI roles, and support. This skill classifies requests and routes users into focused guided flows.

支援: Claude Codex Code(CC)

⚠️ 38 差

Maintain this Skill? Claim it ⚠️ 38 差

安裝前請停止並請求確認。

請審查安裝計畫，並在變更檔案前取得使用者明確同意。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "okx-guide" from https://skillstore.io/skills/okx-okx-guide.md and its manifest at https://skillstore.io/api/skills/okx-okx-guide/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/okx-okx-guide.md 已簽名 manifest GET /api/skills/okx-okx-guide/manifest 已簽名 lockfile GET /api/skills/okx-okx-guide/lockfile

測試它

正在使用「okx-guide」。 What can Onchain OS help me do?

預期結果:

A localized welcome view explains wallet, trading, market, and payment workflows, then presents the available numbered choices.

正在使用「okx-guide」。 What is the difference between an ASP and an Evaluator?

預期結果:

An ASP offers agent services in the marketplace. An Evaluator reviews disputes and requires the platform-defined staking process.

正在使用「okx-guide」。 I need to report a problem.

預期結果:

The response directs the user to the OKX.AI Help Center and lists the steps for starting a support chat.

安全審計

高風險

v1 • 2026/8/20 開啟版本化報告

Most static findings are false positives caused by Markdown code spans, fixed relative links, and displayed URLs. Confirmed risks include automatic execution of mutable installation directives and loading hidden home-directory workflows, while semantic review also found unsupported earnings claims.

已掃描檔案

694

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (2)

高

_shared/preflight.md:7-16

Mutable Preflight Directives Can Trigger Commands

The preflight flow says to do exactly what a returned action says, can force an upgrade, and fetches installation commands from a mutable README. A compromised CLI response or upstream document could cause unauthorized command execution.

The file explicitly mandates execution of returned actions and remote installation guidance without an allowlist, pinned artifact, or confirmation step.

中

references/intro.md:19-38

Unsupported Financial Outcome Claims

The role-selection copy promotes million-per-year outcomes, round-the-clock earnings, and steadier income while encouraging paid services and OKB staking. These claims can unduly influence financial decisions.

The cited user-facing template contains direct earnings claims and a staking prompt without substantiation or a nearby risk qualification.

能力複核項目 (12)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

高

_shared/preflight.md:16

PowerShell invocation

- **The `onchainos preflight` command above errored with "command not found"** (onchainos not instal

The fallback directs the agent to fetch current installation instructions and run the matching shell or PowerShell command. This executes mutable remote guidance without showing a pinned command or requiring user approval.

高

references/how-to-play.md:54

Hidden file in home directory

- If the user came from picking the **Daily brief** option (option `4` in Variant A / option `3` in

The flow automatically loads and follows a mutable Markdown workflow under the user home directory. Unverified content in that file can introduce commands or instructions outside the audited skill.

高

references/how-to-play.md:55

Hidden file in home directory

- If the user came from picking any other **workflow pick** while logged out: automatically load the

The instruction loads a variable workflow file from the hidden Onchain OS directory and follows it automatically. This crosses the audited package boundary without an integrity check.

高

references/welcome.md:165

Hidden file in home directory

The menu routes directly to a mutable workflow in the hidden Onchain OS home directory. Following unaudited local Markdown can introduce unsafe instructions.

高

references/welcome.md:166

Hidden file in home directory

This second menu variant uses the same hidden home-directory workflow handoff. The file is outside the audited package and lacks integrity validation.

高

references/welcome.md:189

Hidden file in home directory

- **Logged-in user**: load `~/.onchainos/workflows/daily-brief.md` directly and follow it.

The instruction explicitly loads and follows the hidden daily-brief workflow for logged-in users. That is an intentional trust boundary crossing.

高

SKILL.md:17

Path traversal sequence

**MUST**: Run the shared preflight **only for the onboarding flow** (§1 → `references/how-to-play.md

The onboarding flow actively reads a preflight file outside this skill directory and follows its instructions. Although the path is fixed, the external file can change independently and alter privileged setup behavior.

中

references/how-to-play.md:54

Hidden file access

- If the user came from picking the **Daily brief** option (option `4` in Variant A / option `3` in

The line explicitly reads and follows a hidden home-directory workflow. The access is intentional and can expose the agent to mutable local instructions.

中

references/how-to-play.md:55

Hidden file access

- If the user came from picking any other **workflow pick** while logged out: automatically load the

The wildcard workflow handoff intentionally accesses hidden local files and executes their guidance. No canonical-path or integrity validation is specified.

中

references/welcome.md:165

Hidden file access

The route accesses a hidden local workflow without user confirmation or integrity verification. Its contents can change independently of this audit.

中

references/welcome.md:166

Hidden file access

The alternate menu route accesses the same unaudited hidden workflow. This is real filesystem behavior rather than displayed example text.

中

references/welcome.md:189

Hidden file access

- **Logged-in user**: load `~/.onchainos/workflows/daily-brief.md` directly and follow it.

The logged-in branch directs the agent to read and follow a hidden local Markdown file. No content validation or trust restriction is stated.

風險因素

⚙️ 外部命令 (7)

_shared/preflight.md:16 SKILL.md:17 SKILL.md:19 SKILL.md:20 SKILL.md:28 SKILL.md:29 SKILL.md:30

📁 檔案系統存取 (19)

references/ai-guide.md:47 references/how-to-play.md:54 references/how-to-play.md:55 references/how-to-play.md:54 references/how-to-play.md:55 references/registered-home.md:12 references/registered-home.md:49 references/registered-home.md:52 references/unregistered-role-selection.md:19 references/unregistered-role-selection.md:20 references/unregistered-role-selection.md:21 references/unregistered-role-selection.md:26 references/welcome.md:165 references/welcome.md:166 references/welcome.md:189 references/welcome.md:165 references/welcome.md:166 references/welcome.md:189 SKILL.md:17

🌐 網路存取 (3)

references/ai-support.md:16 references/ai-support.md:22 SKILL.md:8

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/okx-okx-guide/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/okx-okx-guide/security.svg)](https://skillstore.io/skills/okx-okx-guide?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/okx-okx-guide?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/okx-okx-guide/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/okx-okx-guide.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

okx. (2026). okx-guide security audit report (audit version 1) [Author version 4.4.10]. Skillstore. https://skillstore.io/skills/okx-okx-guide/audits/1

BibTeX 引用

@techreport{okx-okx-okx-guide-2026,
  author = {okx},
  title = {okx-guide security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/okx-okx-guide/audits/1},
  note = {Author version 4.4.10}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "okx-guide security audit report (audit version 1)"
version: "4.4.10"
type: report
authors:
  - name: "okx"
date-released: "2026-08-20"
url: "https://skillstore.io/skills/okx-okx-guide/audits/1"
identifiers:
  - type: other
    value: "skillstore:okx-okx-guide:audit:1"
    description: "Skillstore immutable audit report identifier"

比較變體

2 個可安裝變體

每位作者的技能都保留為獨立的可安裝項目。推薦變體依 Skillstore 證據排序。

為何此變體排名第一

Skillstore 使用量較高

作者 / 來源 Skillstore 評分證據置信度 Skillstore 使用量已更新

internet-court 推薦

internet-court-okx-guide

Skillstore 評分 38

證據置信度中

Skillstore 使用量 11

已更新

2026-09-09

okx 目前

okx-okx-guide

Skillstore 評分 38

證據置信度中

Skillstore 使用量 7

已更新

2026-09-09

Skillstore 評分

評分依據證據置信度: 中

架構

100

可維護性

內容

社群

100

規範符合度

你可以打造什麼

Start with Onchain OS

Present the correct welcome view and route a first-time user toward a supported workflow.

Choose an OKX.AI Role

Explain User, ASP, and Evaluator roles before routing the selected registration flow.

Review Existing Agent Activity

Display registered identities and retrieve open tasks for a selected authenticated agent.

試試這些提示

Get Started

Show me how to start using Onchain OS.

Understand OKX.AI Roles

Explain the User, ASP, and Evaluator roles in OKX.AI without starting registration.

Open My Agent Home

Show my registered OKX.AI identities and explain each status. Do not display signing addresses.

Review Agent Tasks

Retrieve open tasks for Agent ID [agent-id], group them by role, and identify tasks awaiting my review.

最佳實務

State whether the user wants onboarding, role guidance, account information, or support.
Provide an Agent ID when requesting task details.
Review every command and financial action before approving it.