Okx Wallet Portfolio

Use this skill when the user provides a specific wallet address and wants to check its balance, token holdings, portfolio value, or DeFi positions. Typical t...

This skill is coherent for its purpose, but it instructs the agent to download and run an installer from the okx/onchainos-skills GitHub repo at runtime. If you plan to install/use it: (1) only proceed if you trust the okx/onchainos-skills repo; (2) consider manually reviewing the installer script on GitHub before running it or perform the install yourself and point the agent to the already-installed binary; (3) note the skill will write files in your home directory (e.g., ~/.local/bin, ~/.onchainos); (4) verification as written downloads checksums from the same release — this protects against accidental corruption but not against a compromised release — so prefer manual verification (compare the checksum shown in the official release page or verify signatures if available); (5) the skill does not require API keys by default, but may suggest you create one — treat any keys as sensitive and store them securely (do not commit .env). If you are uncomfortable with automatic download-and-execute behavior, install onchainos manually from the official repo and then use the skill.

Type: OpenClaw Skill Name: okx-wallet-portfolio Version: 2.6.0 The skill bundle instructions in SKILL.md direct the AI agent to perform an automated 'curl pipe bash' installation and update process, fetching and executing shell/PowerShell scripts from a GitHub repository (okx/onchainos-skills). While the instructions include SHA256 checksum verification and binary integrity checks, the practice of downloading and executing remote code as a pre-flight step for every command introduces a significant Remote Code Execution (RCE) risk. No evidence of intentional malice, such as data exfiltration or backdoors, was found, but the high-risk execution pattern warrants a suspicious classification.