skills/okx/onchainos-skills/okx-defi/Gen Agent Trust Hub

okx-defi

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The _shared/preflight.md file executes the command npx -y @okxweb3/onchainos-installer. This command downloads and runs an installation script from the vendor's official package repository to configure the skill environment.- [INDIRECT_PROMPT_INJECTION]: The skill ingests and displays information from third-party DeFi protocols, such as product names, protocol identifiers, and reward details. This data is retrieved via the onchainos defi CLI and integrated into the agent's context.
  • Ingestion points: Data returned by search, detail, and positions CLI commands in invest.md and portfolio.md.
  • Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions when displaying data from external protocols.
  • Capability inventory: The agent possesses the ability to execute on-chain transactions, including asset approvals and withdrawals, using the onchainos wallet CLI.
  • Sanitization: There are no explicit instructions for the agent to sanitize or escape strings provided by DeFi protocols before rendering them to the user.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 07:11 AM