OKX Trader
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This appears to be a real OKX trading bot, but it can run live automated trades and its order-cancellation logic may affect orders the user did not intend it to manage.
Only install this if you intentionally want an automated OKX trading bot. Start with OKX simulation mode, use a trade-only subaccount key with withdrawals disabled, do not enable scheduled live maintenance until you have verified the grid settings, and be aware that the current cancellation logic may affect same-size orders outside this bot.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
63/63 vendors flagged this skill as clean.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A rescale could cancel exchange orders the user did not intend this skill to control.
During rescale, the bot selects OKX orders for cancellation by instrument and order size, not by a bot-specific client order ID or tag. Same-size manual orders or orders from another bot could be canceled.
const toCancel = pendingOrders
.filter(o => Math.abs(parseFloat(o.sz) - CONFIG.sizePerGrid) < 0.000001)
.map(o => ({ instId: CONFIG.instId, ordId: o.ordId }));Use unique client order IDs/tags for bot-created orders and cancel only those tagged orders; add a dry-run mode and explicit live-trading confirmation.
The bot could place and cancel real-money crypto orders on a schedule if configured with live credentials.
The skill defines recurring grid maintenance and makes live mode the default unless simulation is explicitly enabled. If the cron template is activated, high-impact trading actions can repeat without per-order confirmation.
"OKX_IS_SIMULATION": { "description": "Enable simulation mode (true/false)", "default": "false" } ... "schedule": "*/5 * * * *", "task": "okx_grid_maintain"Default to simulation mode, require an explicit live-trading opt-in, and review every cron/scheduled task before enabling it.
A user may not realize the skill needs exchange credentials capable of placing and canceling trades.
The registry metadata says no credential is required, but the skill's own configuration requires OKX API credentials. This under-discloses high-impact account access at review/install time.
metadata: "Required env vars: none" / "Primary credential: none"; skill.json: "OKX_API_KEY", "OKX_SECRET_KEY", "OKX_PASSPHRASE" ... "required": true
Clearly declare OKX as the primary credential, require trade-only keys, disable withdrawals, use IP restrictions or a subaccount, and keep balances limited.
Local workspace files may reveal sensitive account performance and strategy details to anyone with access to the workspace.
The snapshot tool persists account equity, asset balances, trading summaries, pending-order counts, and grid settings to local JSON files.
const snapshot = {
timestamp: now.toISOString(),
totalEquityUsd,
assets,
prices,
tradingSummary24h: tradingSummary,
pendingOrders: pendingCounts,
gridSettings: settings
};Store snapshots in a protected directory, avoid sharing the workspace, and define retention/cleanup for old financial snapshots.
It is harder to verify provenance or audit updates before granting exchange-trading authority.
The registry metadata does not surface a clear source or homepage for a high-impact trading skill, even though the package contains executable scripts.
Source: unknown Homepage: none
Verify the publisher, source repository, and version before installing or providing API credentials.