okx-dex-bridge

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and ingests external data (e.g., the preflight step calls the public GitHub API and raw.githubusercontent.com to download installers, and the main workflow repeatedly calls the onchainos CLI to query remote bridge/token/quote APIs and on-chain data such as token names, symbols, and quote/router fields in SKILL.md), and those untrusted/public on-chain or API responses are read and used to decide approvals, route selection, and other actions—so third-party content can materially influence tool use.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's preflight explicitly downloads and executes a remote installer script at runtime (curl to https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.sh followed by sh /tmp/onchainos-install.sh), which fetches and runs remote code as a required dependency, so it directly enables execution of external code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a crypto bridge/execution tool: it enumerates CLI commands that build and broadcast ERC‑20 approve transactions and cross‑chain swap broadcasts (e.g., onchainos cross-chain execute with --confirm-approve / --skip-approve, approve tx submission, broadcasting swaps, and returning fromTxHash/orderId). It manages wallets, approvals, signing/broadcast flow, and full lifecycle status tracking for token transfers across chains. This is specifically designed to move crypto assets (not a generic API caller or browser automation), so it grants direct financial execution capability.