search CA & Token

• Verdict: Pending
• Analyzed: Not checked yet
• Findings: 0
• Version: 1.0.0
• Reason codes: None
• Engine: Not reported

Overview

No static analysis result has been recorded yet. Pattern checks will appear here once the artifact has been analyzed.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

NoteHigh Confidence

What this means

If you run the helper with real OKX credentials, those credentials will be used to authenticate requests to OKX.

Why it was flagged

The helper can read OKX API credentials from environment variables to sign requests. This is expected for OKX API access and the code sends requests only to the documented OKX base URL, but these credentials are sensitive.

Skill content

api_key = os.environ.get('OKX_API_KEY', 'your-api-key')
secret_key = os.environ.get('OKX_SECRET_KEY', 'your-secret-key')
passphrase = os.environ.get('OKX_PASSPHRASE', 'your-passphrase')

Recommendation

Use a least-privilege OKX API key suitable for market-data access only, avoid enabling trading or withdrawal permissions, and store the key/secret/passphrase securely.