okx-cex-market

• Analyzed: May 11, 2026, 5:53 AM
• Findings: 0
• Version: 1.3.3
• Hash: 37f516e73d3dd4a5fa7a0cbbfcd08029b0c9b19b0583bd1d40253b465f742181
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: okx-cex-market Version: 1.3.3 The okx-cex-market skill bundle is a comprehensive and well-documented interface for accessing public OKX market data and technical indicators. It explicitly defines itself as read-only, requires no API credentials, and includes safety instructions for the AI agent to prevent context window exhaustion (e.g., estimating candle counts). The skill uses a standard npm installation pattern for its CLI tool (@okx_ai/okx-trade-cli) and contains no evidence of malicious intent, data exfiltration, or harmful prompt injection across its SKILL.md or reference files.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI04: Agentic Supply Chain Vulnerabilities

Note

What this means

Installing the CLI gives locally executed code from npm the ability to run on the user's machine, even though this skill's documented use is read-only market data.

Why it was flagged

The skill depends on installing and running an external npm CLI package whose code is not included in the supplied artifacts; this is aligned with the market-data CLI purpose, but users should verify package provenance and version before global installation.

Skill content

npm install -g @okx_ai/okx-trade-cli

Recommendation

Verify that the npm package is the expected OKX package, prefer a pinned version matching the skill version, and install it only from a trusted registry/source.

ASI02: Tool Misuse and Exploitation

Note

What this means

The agent may make public OKX market-data queries on the user's behalf without asking each time, but the artifacts do not show order placement or account changes.

Why it was flagged

The skill authorizes the agent to invoke OKX market commands without additional confirmation; the documented commands are read-only and public, so this is proportionate but still worth users noticing.

Skill content

No confirmation needed before running any market command.

Recommendation

Use this for read-only market lookups; request confirmation for broad scans or any workflow that transitions into account, bot, or trading actions.