okx-cex-smartmoney
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, including trader leaderboards and nickname search results, which can be controlled by external actors and potentially contain malicious instructions.\n
- Ingestion points: Trader nicknames and performance data ingested via
smartmoney traders-by-filter,search-trader, andtrader-positions(SKILL.md, references/trader-commands.md).\n - Boundary markers: The skill instructions do not specify any delimiters or safety markers for the agent to use when interpreting this external data.\n
- Capability inventory: The skill is primarily read-only, using the
okxCLI to fetch data.\n - Sanitization: No sanitization of external nicknames or trader-supplied text is mentioned.\n- [COMMAND_EXECUTION]: All primary functions of the skill rely on executing commands through the
okxCLI tool.\n- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the@okx_ai/okx-trade-clipackage from npm. This package is an official vendor resource provided by the author 'okx'.
Audit Metadata