okx-ai

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill docs repeatedly instruct executing server/CLI-provided "playbook" scripts and writing/processing inbound payloads (including saving raw JSON to /tmp and running installer/npm installs), creating de-facto remote-command execution and supply-chain install vectors that can be abused as backdoors or for RCE/exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md’s required runtime workflow includes loading and following references/task-core.md on inbound system/a2a-agent-chat envelopes, and task-core.md/task-evaluator.md/task-user-sub-playbook.md pass the entire inbound message (outsider-authored peer/system content) into the LLM context via the CLI playbook execution path (e.g., next-action --message '<the envelope.message object as a JSON string>'), which can contain free text from other agents/users.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly references on-chain actions and staking flows and hands off wallet/transaction operations to a specific wallet tool. It requires running onchainos CLI commands and preflight steps tied to okx-agentic-wallet (e.g., "broadcast a raw tx → okx-agentic-wallet", "Evaluator staking", "Stake/unstake", chain-fixed XLayer). These are specific crypto/blockchain financial execution capabilities (wallet operations, staking, broadcasting transactions), not generic browser or HTTP tools — therefore it grants Direct Financial Execution Authority.