okx-cex-skill-mp

Use this skill when the user asks to: 'find a trading skill', 'search for skills', 'install a skill', 'add a skill', 'download a skill', 'browse skill market...

This skill appears to be a marketplace manager and its behavior (installing skills from the OKX marketplace) matches that description — but there are inconsistencies in the package metadata and the runtime instructions perform high‑impact actions. Before installing or using it: 1) Verify the OKX CLI package (@okx_ai/okx-trade-cli) is official and from a trusted source (check npm publisher, package integrity, vendor docs). 2) Be cautious about running global npm installs and 'npx' commands — consider testing in an isolated environment. 3) Understand that 'okx skill add' will download and install third‑party skills into your agents' skill directories (and may run install-time scripts); only install skills from authors you trust and inspect the downloaded SKILL.md/_meta.json before enabling them. 4) Resolve the manifest inconsistency: the registry shows no required binaries/env while SKILL.md requires the 'okx' CLI and API credentials — ask the publisher to correct metadata. If you want to limit blast radius, prefer using 'okx skill download' and manually review/unpack the zip rather than automatic 'add' that installs into all agents.

Type: OpenClaw Skill Name: okx-cex-skill-mp Version: 1.3.2 The skill bundle functions as a package manager for the OKX Skills Marketplace, enabling the agent to search for and install third-party code. It is classified as suspicious because its core functionality involves high-risk behaviors: installing a global npm package (@okx_ai/okx-trade-cli), requiring API credentials, and executing a download-and-install flow (okx skill add) that runs unvetted third-party skills with the agent's full system permissions. While these actions are aligned with the stated purpose in SKILL.md, the bundle serves as a high-privilege gateway for potentially malicious third-party content.