Okx Strategy Factory

Agent Team 工厂：协调 5 个 AI Agent（Strategy/Backtest/Infra/Publish/Iteration）完成 OKX OnchainOS 链上交易策略的全生命周期——开发、回测、部署、发布、迭代。支持多策略并行，每个策略独立状态管理。触发词：策略开发、agent team、...

What to check before installing or running this skill: - Do not supply OKX API keys, SSH credentials, or 1Password/secret CLI access to this skill unless you trust the author and understand the deployment targets. The README and references expect OKX API keys and an agent wallet, but the registry metadata did not declare them — this mismatch is suspicious. - Review the bundled scripts (assets/publish.sh, hooks/*.sh) and any deploy.sh referenced by SKILL.md. publish.sh can run git commit/push and copy user-specified scripts; ensure any git remote/credentials and the intended commit/push behavior are safe for your environment. - Note deploy.sh is referenced but not included in the package. Confirm where deploy.sh should come from and inspect it before running; automatic deployment to a VPS will require SSH access and can affect live systems. - Test in a sandbox repository / isolated environment first (no real keys, no real VPS) to observe what files the skill reads/writes and what commands it would execute. - If you plan to run real backtests or deploy live, provide credentials via a managed secret store (not direct chat) and limit the keys' scope (trade permissions, restricted IPs) and balance exposure. - If you need clarity from the author: ask where deploy.sh comes from, which git remotes the publish script will push to, and whether the skill collects or transmits any telemetry externally. If the answers are unclear or absent, avoid giving secrets or running deploy/publish steps.

Type: OpenClaw Skill Name: okx-strategy-factory Version: 2.0.1 The skill bundle implements a multi-agent pipeline for developing, backtesting, and deploying OKX trading strategies. It includes high-risk capabilities such as VPS deployment via SSH/SCP (roles/infra.md), automated git publishing (assets/publish.sh), and shell command execution via a suggested Python wrapper for the onchainos CLI (references/api-interfaces.md). While these features align with the stated goal of a 'Strategy Factory,' the combination of automated financial trading, credential handling (OKX and SSH keys), and the potential for argument injection in agent-generated code presents a significant attack surface. No explicit evidence of intentional malice or data exfiltration was found, but the broad execution capabilities and the complexity of the automated deployment flow warrant a suspicious classification.