⚠️ Plugin Review: issues found in 56d41c7

[github-actions]

Issues after push to main

Commit: 56d41c7
Plugins: meme-trench-scanner okx-buildx-hackathon-agent-track plugin-store polymarket-agent-skills smart-money-signal-copy-trade top-rank-tokens-sniper uniswap-ai

Static Checks

⚠️ [meme-trench-scanner] Version mismatch: plugin.json=1.0.0 vs SKILL.md=1.0
⚠️ [smart-money-signal-copy-trade] Version mismatch: plugin.json=1.0.0 vs SKILL.md=1.0
⚠️ [top-rank-tokens-sniper] Version mismatch: plugin.json=1.0.0 vs SKILL.md=1.0

AI Review

Summary

This is a comprehensive security review of 8 plugins for the OKX Plugin Store. All plugins contain trading bot functionality with real money exposure, requiring extensive security validation.

Issues Found

🔴 Critical:

• [meme-trench-scanner, smart-money-signal-copy-trade, top-rank-tokens-sniper] Version mismatches between plugin.json (1.0.0) and SKILL.md (1.0) create confusion and may cause installation issues
• [meme-trench-scanner, smart-money-signal-copy-trade, top-rank-tokens-sniper] Default configs have PAUSED=True and PAPER_TRADE=True which is correct for safety, but the extensive Python code (1000+ lines each) contains complex trading logic with potential for bugs in live trading scenarios
• [All trading plugins] Extremely complex trading bots with multi-threaded execution, file I/O, network calls, and real money transactions - the codebase complexity significantly increases attack surface

🟡 Important:

• [meme-trench-scanner] Contains hardcoded protocol IDs and API endpoints that could become stale
• [All trading plugins] Heavy reliance on onchainos CLI availability and proper configuration - failure modes could leave positions unmonitored
• [okx-buildx-hackathon-agent-track] Contains instructions for human interaction that could be manipulated through prompt injection to bypass security checks
• [plugin-store] Self-update mechanism could potentially be exploited if GitHub content is compromised

🔵 Minor:

• [polymarket-agent-skills, uniswap-ai] Minimal stub implementations redirect to external repositories - content not fully validated
• [plugin-store] Pre-flight version checking creates external dependency that could fail

Verdict

⚠️ Fix issues first

While no immediate security vulnerabilities were found, the critical version mismatches must be resolved and the massive complexity of the trading bot code requires additional scrutiny before deployment. The trading plugins represent significant financial risk and should undergo additional testing and code review given their scope.