Okx Dex Bridge

Use this skill to bridge tokens, cross-chain swap/transfer, move assets between chains, get cross-chain quotes, compare bridge fees, find the cheapest/fastes...

This skill is coherent with a cross-chain CLI workflow but has some gaps you should be aware of before installing or running it: - The SKILL.md expects the 'onchainos' CLI and server authentication (JWT or AK env vars), but the skill metadata lists no required binaries or environment variables. Assume you'll need to install the CLI and provide wallet/API credentials. - The provided preflight instructs downloading an installer (install.sh / install.ps1) from GitHub and executing it. Although it also instructs verifying SHA256 checksums (good practice), downloading-and-running install scripts is inherently risky. Prefer to: - Manually inspect the installer script at the referenced GitHub release before executing it. - Verify the checksum and the release authenticity on GitHub (check the repo, publisher, and release history). - If possible, install the CLI from the official OKX website or package manager instead of via an automated script. - Expect the tool to ask for authentication (wallet login or API key). Do not paste private keys or secrets into untrusted shells; prefer using secure local wallet tooling or ephemeral credentials. - If you need higher assurance, ask the skill publisher for an explicit manifest update that declares the required binary ('onchainos') and any environment variables needed (JWT, AK_*, etc.), or run the CLI in an isolated environment (VM/container) first. Given these mismatches (undeclared CLI and secret usage plus a download-and-execute install flow), treat the skill with caution and validate the installer and auth flows before use.

Type: OpenClaw Skill Name: okx-dex-bridge Version: 2.6.0 The skill bundle implements a cross-chain bridging interface but contains high-risk execution patterns in its setup logic. Specifically, `_shared/preflight.md` performs automated installation and updates by fetching and executing shell scripts directly from GitHub (the `curl|sh` pattern). While the process includes SHA256 checksum verification to mitigate tampering, this behavior constitutes a significant remote code execution (RCE) surface and supply-chain risk. The remaining files, including `SKILL.md` and `references/cli-reference.md`, appear to be legitimate documentation for the OKX DEX bridge, incorporating numerous safety checks and mandatory user confirmations for financial operations.