okx-dex

OKX DEX aggregator (v6). Get swap quotes, swap/approve tx data, tokens, and chains.

This skill appears to implement a genuine OKX DEX API client, but there are important red flags you should address before installing: (1) The repository/registry metadata does NOT declare the three required secrets although SKILL.md and scripts do — verify the publisher and the provenance. (2) The SKILL.md contains inconsistent variable names (SECRET_KEY vs OKX_SECRET_KEY) and brittle signing snippets; test in a safe environment first. (3) The skill is configured 'always: true' which forces it into every agent session — remove or question this unless you need it always available. If you proceed, only provide API keys with minimal permissions, consider creating a dedicated OKX key you can revoke, and monitor/rotate keys after initial use. If the publisher cannot explain the metadata mismatches and justify always:true, treat the package as untrusted.

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill Suspicious High-Entropy/Eval files: 1 The OpenClaw skill 'okx-dex' is designed to interact with the official OKX DEX aggregator API for cryptocurrency operations. It uses standard tools (`curl`, `jq`, `python3`) to fetch data and construct authenticated API requests to `https://web3.okx.com`. API credentials (`OKX_API_KEY`, `OKX_SECRET_KEY`, `OKX_PASSPHRASE`) are securely accessed from environment variables for HMAC signing and authentication headers, with no evidence of exfiltration or insecure handling. Crucially, the `SKILL.md` includes 'Safety Rules' that explicitly instruct the AI agent to display swap details, warn about risks, and 'NEVER execute without explicit user confirmation,' actively mitigating prompt injection risks and promoting transparency.