okx-security
Use this skill for security scanning: check transaction safety, is this transaction safe, pre-execution check, security scan, token risk scanning, honeypot detection, DApp/URL phishing detection, message signature safety, malicious transaction detection, approval safety checks, token approval management. Triggers: 'is this token safe', 'check token security', 'honeypot check', 'scan this tx', 'scan this swap tx', 'tx risk check', 'is this URL a scam', 'check if this dapp is safe', 'phishing site check', 'is this signature safe', 'check this signing request', 'check my approvals', 'show risky approvals', 'revoke approval', 'check if this approve is safe', token authorization, ERC20 allowance, Permit2. Covers token-scan, dapp-scan, tx-scan (EVM+Solana pre-execution), sig-scan (EIP-712/personalsign), approvals (ERC-20/Permit2). Chinese: 安全扫描, 代币安全, 蜜罐检测, 貔貅盘, 钓鱼网站, 交易安全, 签名安全, 代币风险, 授权管理, 授权查询, 风险授权, 代币授权. Do NOT use for wallet balance/send/history — use okx-agentic-wallet.
- Installs
- 6.5K
- Last 24h
- —
- Trending rank
- —
- Security
- Warn
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/okx/onchainos-skills --skill okx-security- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads okx-security automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
Security audits
Independent scans of the skill's instructions and bundled files.
SKILL.md
The instructions your agent reads when the skill is triggered.
Onchain OS Security
5 commands for token risk analysis, DApp phishing detection, transaction pre-execution security, signature safety, and approval management.
Pre-flight Checks
Read
../okx-agentic-wallet/_shared/preflight.md. If that file does not exist, read_shared/preflight.mdinstead.
Fail-safe Principle (CRITICAL)
Scan completed — risk detected
If a security scan completes successfully and returns action: "block" or action: "warn", follow the Risk Action Priority Rule below. The Agent MUST NOT override risk verdicts.
Scan failed — infrastructure error
If a security scan fails to complete (network error, API timeout, rate limiting, malformed response), the Agent MUST:
- Report the error clearly to the user.
- Ask the user whether to retry the scan or proceed without scan results.
- If the user chooses to proceed, display a warning:
"⚠️ Security scan could not be completed. Proceeding without verification — please ensure you trust this operation."
- Log the skipped scan for auditability.
A security scan that fails to complete is NOT a "pass". Always inform the user and let them make an explicit decision.
Risk Action Priority Rule
tx-scan / sig-scan (transaction & signature scanning)
block > warn > safe (empty). The top-level action field reflects the highest priority from riskItemDetail.
action value | Risk Level | Agent Behavior |
|---|---|---|
| (empty/null) | Low risk | Safe to proceed |
warn | Medium risk | Show risk details, ask for explicit user confirmation |
block | High risk | Do NOT proceed, show risk details, recommend cancel |
- Risk scan result is still valid even if simulation fails (
simulator.revertReasonmay contain the revert reason). - If
warningsfield is populated, the scan completed but some data may be incomplete. Still present available risk information. - An empty/null
actionin a successful API response means "no risk detected". But if the API call failed, the absence ofactiondoes NOT mean safe — apply the fail-safe principle.
token-scan (token risk label scanning)
Token-scan returns a riskLevel field (CRITICAL, HIGH, MEDIUM, LOW) that represents the overall token risk, computed server-side from all boolean labels, tax thresholds, and additional signals (off-chain intelligence, ML models). The Agent uses this field directly and applies different actions for buy vs. sell operations.
riskLevel | Buy Action | Sell Action |
|---|---|---|
| CRITICAL | block — refuse to buy | warn — display risk, allow sell |
| HIGH | warn + pause — require explicit yes/no | warn — display risk, allow sell |
| MEDIUM | warn — info notice, continue | warn — info notice, continue |
| LOW | safe — proceed | safe — proceed |
Full label catalog, tax threshold rules, and display format are defined in
references/risk-token-detection.md. Always load that reference before executingtoken-scan.
Key principles:
riskLevelis authoritative: The API returns the overall risk level server-side. The Agent readsriskLeveldirectly — no client-side computation from individual labels is needed.- Buy is stricter than sell:
CRITICALblocks buy but only warns on sell (to allow stop-loss exit). HIGHbuy requires explicit user confirmation (yes/no) — do not auto-continue.- Individual label levels are not displayed to the user — only the overall
riskLevelis shown, with triggered labels listed without level prefixes. - If
isChainSupported: false, skip detection with a warning; do not block. - If API fails, warn but do not block. In swap context, token-scan failures auto-continue with a warning to avoid blocking time-sensitive trades — this overrides the general fail-safe's ask-user behavior.
Security commands do not require wallet login. They work with any address.
Chain Name Support
The CLI accepts human-readable chain names and resolves them automatically.
| Chain | Name | chainIndex |
|---|---|---|
| XLayer | xlayer | 196 |
| Ethereum | ethereum or eth | 1 |
| Solana | solana or sol | 501 |
| BSC | bsc or bnb | 56 |
| Polygon | polygon or matic | 137 |
| Arbitrum | arbitrum or arb | 42161 |
| Base | base | 8453 |
| Avalanche | avalanche or avax | 43114 |
| Optimism | optimism or op | 10 |
| zkSync Era | zksync | 324 |
| Linea | linea | 59144 |
| Scroll | scroll | 534352 |
Address format note: EVM addresses (0x...) work across Ethereum/BSC/Polygon/Arbitrum/Base etc. Solana addresses (Base58) and Bitcoin addresses (UTXO) have different formats. Do NOT mix formats across chain types.
Related Workflows
When one of the following commands is used, show the related workflow hint after displaying results:
| Command | Workflow | File |
|---|---|---|
security token-scan | New Token Screening | ~/.onchainos/workflows/new-token-screening.md |
security token-scan | Smart Money Signals | ~/.onchainos/workflows/smart-money-signals.md |
security token-scan | Token Research | ~/.onchainos/workflows/token-research.md |
security token-scan | Wallet Monitor | ~/.onchainos/workflows/wallet-monitor.md |
Hint format: "You can also try out our [workflow name] workflow for more comprehensive results. Would you like to try it?"
Command Index
| # | Command | Description |
|---|---|---|
| 1 | onchainos security token-scan | Token risk / honeypot detection (all chains) |
| 2 | onchainos security dapp-scan | DApp / URL phishing detection (chain-agnostic) |
| 3 | onchainos security tx-scan | Transaction pre-execution security (EVM + Solana) |
| 4 | onchainos security sig-scan | Message signature security (EVM only) |
| 5 | onchainos security approvals | Token approval / Permit2 authorization query (EVM only) |
Reference Loading Rules (MANDATORY)
Before executing ANY security command, you MUST read the corresponding reference document from skills/okx-security/references/. Do NOT rely on prior knowledge — always load the reference first.
| User intent | Read this file FIRST |
|---|---|
| Token safety, honeypot, is this token safe, 代币安全, 蜜罐检测, 貔貅盘 | references/risk-token-detection.md |
| DApp/URL phishing, is this site safe, 钓鱼网站 | references/risk-domain-detection.md |
| Transaction safety, tx pre-execution, signature safety, approve safety, 交易安全, 签名安全 | references/risk-transaction-detection.md |
| Approvals, allowance, Permit2, revoke, 授权管理, 授权查询, 风险授权 | references/risk-approval-monitoring.md |
When a workflow involves multiple commands (e.g., token-scan then tx-scan), load each reference before executing that command.
Integration with Other Skills
Security scanning is often a prerequisite for other wallet operations:
- Before
wallet sendwith a contract token: runtoken-scanto verify token safety - Before
wallet contract-callwith approve calldata: runtx-scanto check spender - Before interacting with any DApp URL: run
dapp-scan - Before signing any EIP-712 message: run
sig-scan
Use okx-agentic-wallet skill for the subsequent send/contract-call operations.
FAQ
What does the okx-security skill do?
Use this skill for security scanning: check transaction safety, is this transaction safe, pre-execution check, security scan, token risk scanning, honeypot detection, DApp/URL phishing detection, message signature safety, malicious transaction detection, approval safety checks, token approval management. Triggers: 'is this token safe', 'check token security', 'honeypot check', 'scan this tx', 'scan this swap tx', 'tx risk check', 'is this URL a scam', 'check if this dapp is safe', 'phishing site check', 'is this signature safe', 'check this signing request', 'check my approvals', 'show risky approvals', 'revoke approval', 'check if this approve is safe', token authorization, ERC20 allowance, Permit2. Covers token-scan, dapp-scan, tx-scan (EVM+Solana pre-execution), sig-scan (EIP-712/personalsign), approvals (ERC-20/Permit2). Chinese: 安全扫描, 代币安全, 蜜罐检测, 貔貅盘, 钓鱼网站, 交易安全, 签名安全, 代币风险, 授权管理, 授权查询, 风险授权, 代币授权. Do NOT use for wallet balance/send/history — use okx-agentic-wallet.
How do I install okx-security?
Run npx skills add https://github.com/okx/onchainos-skills --skill okx-security in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/okx-security/ (personal) or .claude/skills/okx-security/ (project).
Which AI agents can use okx-security?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is okx-security safe to install?
Security partners have reviewed it: Gen Agent Trust Hub passed; Socket passed; Snyk flagged items to review; ZeroLeaks passed. As with any skill, read the SKILL.md and bundled scripts before installing.
Who maintains okx-security?
It is published by okx in okx/onchainos-skills. It has 6,499 recorded installs.
More from okx/onchainos-skills
okx-dex-market
okx/onchainos-skills
Query read-only DEX token, market, signal, social, trenches, and WebSocket data. Use for token search, rankings, liquidity, holders, risk metadata, clusters, and trades; prices, K-lines/OHLC, indexes, and wallet PnL; smart-money/KOL/whale signals; news, sentiment, and token vibe; meme-launch, developer, bundle/sniper, and co-investor research; or DEX WebSocket clients. Triggers include hot tokens, holder concentration, smart money, top-trader leaderboards, pump.fun research, new token launches, on-chain token scanning, bundled or sniper activity, and WebSocket.
okx-agentic-wallet
okx/onchainos-skills
Operate OKX Onchain OS wallets and execute or inspect on-chain transactions. Use for wallet login/status/accounts/addresses/balances/holdings; receive/send/transfer; swaps, bridges, limit orders, contract calls, gas estimation, simulation, broadcast, and tracking; Bitcoin UTXO/BRC-20/inscriptions; signing, approvals, wallet policy/export, public-address portfolios, security checks, and audit logs.
okx-dapp-discovery
okx/onchainos-skills
Discover supported third-party DApps and route protocol-specific requests to OKX plugins without signing or broadcasting. Use for DApp discovery or comparison; a named protocol's operations or analytics; Polymarket/UpDown prediction markets, bets, and positions; protocol-native actions involving HYPE/HLP, stETH/wstETH, CAKE, CRV, COMP, RAY, GHO, or PT/YT; pump.fun writes; and unsupported-DApp alternatives. Supported DApp names include Aave, Hyperliquid, PancakeSwap, Morpho, Raydium, Curve, Compound, Pendle, Lido, ether.fi, GMX, Kamino, Orca, Meteora, Clanker, and pump.fun. Requests to find, buy, or subscribe to a signal or signal service are OKX.AI marketplace workflows, even when they name Polymarket or another DApp.
okx-agent-payments-protocol
okx/onchainos-skills
Handle agent payments and paid endpoints via x402, MPP, payment links, a2a-pay, and HTTP-payment recurring or metered billing. Use for HTTP 402/payment-required; paid Agent or A2MCP endpoints; x402/Permit2; MPP channels, vouchers, or sessions; HTTP-payment subscriptions; or paymentId/link operations or status. Trigger phrases: x402/x402Version, X-PAYMENT, PAYMENT-REQUIRED, PAYMENT-SIGNATURE, WWW-Authenticate: Payment, x402 exact/exact+Permit2/upto/aggrdeferred, MPP charge/session, channelId/channelid, payment-channel voucher/topup/settle/refund, metered billing, paymentId, a2a, payment link, A2MCP, paid endpoint, and HTTP 402 period/permit2subscription.
okx-growth-competition
okx/onchainos-skills
List OKX Agentic Wallet exclusive trading competitions, register users for contests, track participation and leaderboard rankings, and claim won rewards. Use when users want to list available trading competitions or trading cups, view competition rules / prize pool / total prizes, register or sign up or enroll or join a contest, check the leaderboard (who is winning) or their own rank (am I in the prize zone, what is my place), ask did I win or query participation / claim status, claim won rewards or prizes from completed competitions, see which wallet account they registered with, or submit Telegram / WeChat / Email / Twitter contact for prize delivery to top-tier winners.
okx-guide
okx/onchainos-skills
Guide users through installing or updating Onchain OS, getting started, OKX.AI introduction and role-registration routing, and customer support. Use when someone wants to install or update the Onchain OS CLI or skills, is new or asks what Onchain OS or OKX.AI is, wants a quick start, needs to register a User, ASP, or Evaluator role, or asks for Help Center, support, feedback, or FAQs.
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.