DEX Swap & Broadcast

• Outcome: Review
• Latest audit: May 28, 2026 at 3:50 AM UTC
• Version:
  1.0.0

Overview

This skill appears purpose-built for OKX token swaps, but it can use wallet/API secrets to approve and submit real crypto transactions without a required confirmation checkpoint.

Install only if you intend to let an agent help with real on-chain swaps. Prefer an external wallet or hardware signer over pasting private keys, use least-privilege OKX API credentials, require manual confirmation before every approval, signing, and broadcast step, approve exact amounts when possible, and revoke unused allowances after swaps.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill is explicitly designed to approve tokens, sign transactions, and broadcast irreversible on-chain swaps, but the introductory description lacks a prominent warning that these actions move assets and cannot be undone once confirmed. In a DeFi execution skill, missing that warning materially increases the risk of users or agents triggering real asset loss through misunderstanding or automation.

VirusTotal

64/64 vendors flagged this skill as clean.