okx-task-watch

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill explicitly requires claiming decision_request items and executing the provided "llmContent" verbatim (arbitrary CLI/tool/agent/wallet calls), and it permits reading background output files — behaviour that enables remote code execution, arbitrary command execution, and potential data exfiltration or credential theft if untrusted input is accepted.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Runtime LLM context can include outsider-authored free text because okx-a2a user watch --json returns kind == notification / decision_request items whose userContent is pasted verbatim into the assistant message (and thus into the agent’s LLM-visible context), and those bodies are authored by external parties (e.g., other users/OKX task participants) rather than the operating user.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly instructs the agent to execute the commands named in an item's llmContent verbatim after claiming a decision_request. The documentation even lists "a wallet / onchain call" as an example of what llmContent may contain and says to "just follow it." That is a direct capability to perform crypto/blockchain transactions (wallet/onchain calls), which is a specific financial-execution function. Therefore this skill grants Direct Financial Execution authority.