okx-cex-skill-mp
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates downloading the official
@okx_ai/okx-trade-clipackage from npm and third-party AI skills from the OKX marketplace. - [COMMAND_EXECUTION]: Executes terminal commands using the
okxCLI andnpxto manage configurations and skill installations. - [PROMPT_INJECTION]: The skill serves as a gateway for third-party content, presenting an indirect prompt injection surface.
- Ingestion points: Untrusted data enters the environment through the
okx skill addandokx skill downloadcommands, as well as theskills_searchMCP tool. - Boundary markers: The skill provides a prominent 'Third-Party Content Notice' warning users that marketplace content is not reviewed by OKX and advising review of
SKILL.mdfiles. - Capability inventory: The skill uses the
okxCLI to write files to the agent's local skill directory (e.g.,~/.agents/skills/). - Sanitization: No explicit sanitization or validation of the downloaded prompt content is performed by this management skill.
Audit Metadata