strategy-ranking-sniper
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill automates the installation of its binary dependencies by downloading shell scripts from OKX's GitHub repositories and piping them directly to the shell.
- Evidence:
curl -sSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | sh - Evidence:
curl -sSL https://raw.githubusercontent.com/okx/plugin-store/main/install_strategy.sh | sh -s -- strategy-ranking-sniper - [DYNAMIC_EXECUTION]: Uses Python to dynamically parse JSON data fetched from the GitHub API to calculate and display download statistics for the user.
- Evidence:
curl -s "https://api.github.com/repos/okx/plugin-store/releases?per_page=100" | python3 -c "import json,sys;d=json.load(sys.stdin);print(...)" - [EXTERNAL_DOWNLOADS]: Regularly checks for updates by querying the official OKX plugin-store repository on GitHub and suggests installation commands for new versions.
- Evidence:
curl -sSf --max-time 3 "https://api.github.com/repos/okx/plugin-store/releases/latest" - [COMMAND_EXECUTION]: Orchestrates the onchainos CLI and the strategy-ranking-sniper daemon to manage wallet status, check balances, and execute the trading loop.
- Evidence:
onchainos wallet status,strategy-ranking-sniper start,strategy-ranking-sniper balance. - [INDIRECT_PROMPT_INJECTION]: The skill operates on data fetched from external DEX ranking and token safety APIs, which is a standard risk for market analysis tools as the agent must process external content.
- Ingestion points: OKX
/token/toplist,/token/advanced-info, and/token/holderendpoints used in thetickandanalyzecommands. - Capability inventory: Includes the ability to execute shell commands via the strategy-ranking-sniper binary and perform blockchain transactions via the onchainos CLI.
- Boundary markers: The instructions do not define explicit delimiters for the agent to ignore potential instructions embedded in the API responses.
- Sanitization: No explicit sanitization or validation of the API payload content is mentioned in the skill instructions.
Audit Metadata