OKX MCP Skill

Use OKX OnchainOS MCP through UXC for token discovery, market data, wallet balance, and swap execution planning. Use when tasks need OKX MCP tools such as to...

Key issues to consider before installing: (1) SKILL.md requires the 'uxc' CLI and uses a linked command 'okx-mcp-cli' but the skill metadata advertises no required binaries — ensure you have uxc installed and trust that CLI. (2) The skill expects an OKX API key (examples show OKX_ACCESS_KEY or op:// vault paths) but metadata doesn't declare required env vars; do not store sensitive keys in places you don't control. (3) The README includes a public demo API key — fine for read-only testing but replace it for production. (4) The op:// example references an organizational secret path; confirm you understand where secrets would be stored and that you won't accidentally grant access to broader vaults. (5) If you need stronger assurance, ask the publisher to update metadata to declare required binaries (uxc, okx-mcp-cli) and env vars, and to remove or clearly label any demo keys / example secret paths. Run this skill in a restricted environment until you verify behavior.

Type: OpenClaw Skill Name: okx-mcp-skill Version: 1.0.1 The skill bundle is benign. It provides instructions and examples for interacting with the OKX OnchainOS MCP API via the `uxc` tool. The documentation (`SKILL.md`, `references/usage-patterns.md`) explicitly instructs the AI agent to require user confirmation for high-impact operations like `dex-okx-dex-approve-transaction` and `dex-okx-dex-swap`, which is a strong security measure against prompt injection for critical actions. API keys are handled securely via environment variables or 1Password (`secret-env`, `secret-op`), and a provided trial key is explicitly stated as read-only. The `scripts/validate.sh` enforces good documentation practices, including avoiding generic commands that could be abused. No evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation was found.