Security checks across malware telemetry and agentic risk
This OKX trading skill is not clearly malicious, but it grants real-money trading authority with several controls that are too broad for a financial agent.
Install only if you understand that this skill can access OKX account data and, when configured, place live trades or transfer funds. Keep paper trading enabled first, avoid setting OKX_API_URL unless you control the endpoint, do not enable auto_trade or cron jobs until limits are configured, and use API keys with the minimum OKX permissions needed.
missing.append(pkg)
if missing:
print(f"Installing: {', '.join(missing)}")
subprocess.check_call([sys.executable, "-m", "pip", "install"] + missing, stdout=subprocess.DEVNULL)
print("Done.")if time.time() - _last_sync < 300:
return
try:
r = requests.get(f"{BASE_URL}/api/v5/public/time", timeout=5)
server_ms = int(r.json()["data"][0]["ts"])
_time_offset = server_ms / 1000 - time.time()
_last_sync = time.time()try:
headers = self._headers(method, full_path, data or "")
if method == "GET":
r = requests.get(url, headers=headers, timeout=10)
else:
r = requests.post(url, headers=headers, data=data, timeout=10)
if not r.ok:if method == "GET":
r = requests.get(url, headers=headers, timeout=10)
else:
r = requests.post(url, headers=headers, data=data, timeout=10)
if not r.ok:
try:
err = r.json()64/64 vendors flagged this skill as clean.