DEX Aggregator Quote

• Verdict: Pass
• Confidence: High
• Analyzed: May 1, 2026, 5:53 AM
• Findings: 1
• Version: 1.0.0

Overview

The skill appears aligned with fetching OKX DEX quote data, but users should notice that it requires OKX API credentials.

Before installing or using this skill, confirm you are comfortable giving it OKX Web3 API credentials. Prefer a separate, minimally scoped key for quote access only, and avoid using any key that can trade, withdraw funds, or manage account settings.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

NoteHigh Confidence

What this means

You must provide OKX API credentials; if those credentials have broader permissions, mishandling them could affect your OKX account or API access.

Why it was flagged

The skill requires API credentials and a secret/passphrase to authenticate OKX requests. This matches the stated OKX quote-client purpose, but the credentials are sensitive and should be scoped appropriately.

Skill content

required_context: [api_key, secret_key, passphrase] ... Users must have an OKX Web3 API key set. The skill needs three values: OKX_ACCESS_KEY, OKX_SECRET_KEY, OKX_PASSPHRASE

Recommendation

Use a dedicated OKX Web3 API key with the minimum permissions needed for quote access, avoid trading or withdrawal-capable keys, and do not print or share the secret key or passphrase.