okx-growth-competition
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns detected. The skill implements strict identity resolution, uses fixed output templates for all user-facing messages, and avoids exposing internal identifiers.
- [PROMPT_INJECTION]: The skill processes competition data, leaderboards, and user statuses retrieved from official OKX APIs via tool calls. This establishes an indirect prompt injection surface where external data is interpolated into prompt templates.
- Ingestion points: Data returned from
onchainos competitiontools (list, detail, rank, user-status) as documented inreferences/cli-reference.md. - Boundary markers: The skill relies on structured tool output but does not utilize explicit markers or instructions to ignore embedded content within the ingested data.
- Capability inventory: The skill is capable of joining competitions, claiming rewards, and initiating token swaps (via delegation to the
okx-agentic-walletskill). - Sanitization: No explicit sanitization or validation of text fields (such as competition names or user nicknames) is defined before rendering into user-facing templates.
- [EXTERNAL_DOWNLOADS]: The skill references official OKX domains (
web3.okx.com) for competition landing pages and winner lists. These are well-known services provided by the skill author and are documented neutrally.
Audit Metadata