okx-agent-payments-protocol

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs the agent to capture user-supplied request parameters (including examples like "token=0x…") and to display them verbatim in the confirmation card (" = "), and also to replay returned authorization headers, which forces the LLM to handle secret/token values and potentially emit them verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow ingests outsider-authored free text from the runtime HTTP 402 server response (e.g., PAYMENT-REQUIRED body JSON or WWW-Authenticate: Payment base64 request) which is decoded into display/selection content and used in subsequent LLM-visible steps/cards.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to perform cryptocurrency payments and signing. It defines EVM/ERC-20 payment fields (chainId, currency, recipient), requires wallet login and signing (TEE vs local private key), and calls concrete payment commands (onchainos payment pay, onchainos payment pay-local) and wallet-status/login commands. It also instructs replaying requests with returned authorization headers and handling Permit2 / EIP-3009 flows — all are direct financial execution operations (crypto payments/wallet signing). These are specific payment APIs/commands, not generic tooling.