OKX Exchange WebSocket Skill

• Analyzed: May 11, 2026, 6:48 AM
• Findings: 0
• Version: 1.0.0
• Hash: e88e49fd5ea8f716cecdc813760c2b05b14b3a42187f549d32a65429f83c8bf8
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: okx-exchange-websocket-skill Version: 1.0.0 The skill provides legitimate instructions and configurations for an AI agent to interact with the OKX public WebSocket API using the 'uxc' CLI tool. The commands in SKILL.md and usage-patterns.md are focused on market data (tickers, trades, order books) and use the official OKX endpoint (wss://ws.okx.com:8443/ws/v5/public). No indicators of malicious intent, data exfiltration, or unauthorized execution were found.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

Note

What this means

Running the command can start a live market-data feed and create or grow a local NDJSON file.

Why it was flagged

The skill instructs use of an external CLI to open a WebSocket connection and write output to a local file. This is the advertised function and is scoped to public OKX data, but it is still tool execution with file output.

Skill content

Core Workflow: `uxc subscribe start wss://ws.okx.com:8443/ws/v5/public --transport websocket --init-frame ... --sink file:$HOME/.uxc/subscriptions/okx-btcusdt-ticker.ndjson`

Recommendation

Run it only for intended public channels, verify the endpoint and subscribe frame, and choose a sink path you are comfortable writing to.

ASI10: Rogue Agents

Note

What this means

A subscription left running could keep a network connection open and continue growing the output file.

Why it was flagged

The documented stop step indicates that subscription jobs can continue after being started. The persistence is disclosed and aligned with streaming WebSocket data.

Skill content

Stop the job when finished: `uxc subscribe stop <job_id>`

Recommendation

Use `uxc subscribe list`, `uxc subscribe status`, and `uxc subscribe stop` to monitor and stop jobs when they are no longer needed.

ASI04: Agentic Supply Chain Vulnerabilities

Note

What this means

The behavior depends on whichever `uxc` binary is installed locally.

Why it was flagged

The skill depends on an external `uxc` runtime, while the provided registry metadata declares no required binaries or install spec. Users must independently trust and manage that dependency.

Skill content

Prerequisites: - `uxc` is installed and available in `PATH`.

Recommendation

Install `uxc` from a trusted source and consider declaring it in the skill metadata for clearer dependency review.