strategy-grid-trade
Fail
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill downloads and executes installation scripts directly from the OKX organization's GitHub repositories to install the 'onchainos' and 'plugin-store' CLI tools.
- [EXTERNAL_DOWNLOADS]: Fetches executable binaries and script dependencies from official GitHub repositories associated with OKX to enable trading functionality.
- [DYNAMIC_EXECUTION]: Employs an inline Python script to process JSON data retrieved from the GitHub API, calculating and displaying bot usage statistics within the user interface.
- [COMMAND_EXECUTION]: Orchestrates local binaries such as 'onchainos', 'plugin-store', and 'strategy-grid' to perform automated market analysis, balance checks, and trade executions.
- [INDIRECT_PROMPT_INJECTION]: 1. Ingestion points: The skill ingests external price data from the OKX DEX quote API and blockchain balance data from the Base network. 2. Boundary markers: The instructions lack explicit delimitation or directives to the agent to ignore instructions that might be embedded in external data. 3. Capability inventory: The skill has the ability to execute cryptocurrency swaps and modify local configuration and state files. 4. Sanitization: No evidence was found of data validation or sanitization for external market inputs before they influence trading logic.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh, https://raw.githubusercontent.com/okx/plugin-store/main/install.sh, https://raw.githubusercontent.com/okx/plugin-store/main/install_strategy.sh - DO NOT USE without thorough review
Audit Metadata