okx-cex-smartmoney

Smart Money analytics on OKX: leaderboard traders, position tracking, trade records, aggregated consensus signals, and signal history. Use this skill when th...

Security Scan

The skill's behavior (OKX CLI usage and need for OKX API credentials) is coherent with its stated purpose, but there are inconsistent metadata/install declarations and an implicit request to install an npm CLI package that you should verify before installing.

Purpose & Capability

The skill is described as OKX Smart Money analytics and the SKILL.md instructs use of the official-looking `okx` CLI and OKX API credentials — this matches the declared purpose. However, the package registry metadata shown to you earlier reported 'no required binaries / no install spec', while the SKILL.md frontmatter requires the `okx` binary and lists an npm install (@okx_ai/okx-trade-cli@1.3.2). That metadata mismatch is inconsistent and should be resolved before trusting the skill.

Instruction Scope

Runtime instructions are limited to read-only analytics commands (smartmoney traders, signal, overview, etc.), credential/profile checking via `okx config`, rendering JSON output as tables, and basic network checks. The skill explicitly warns not to paste API keys into chat. It does reference the user's local config file (~/.okx/config.toml) for credentials (reasonable for a CLI-based integration). There are no instructions to read unrelated files, environment variables, or exfiltrate data.

Install Mechanism

The SKILL.md frontmatter and preflight recommend installing an npm package (@okx_ai/okx-trade-cli) to provide the `okx` CLI. Installing an npm package is a moderate-risk action and is proportionate to the skill's purpose, but the registry/manifest you were shown earlier claimed 'No install spec' and 'No required binaries' — that discrepancy is a red flag. Before installing, verify the npm package name, publisher, repository, and release authenticity (avoid running unknown install scripts).

Credentials

The skill does not request environment variables from the skill registry and instructs the user to configure OKX API credentials locally via `okx config`. Requesting OKX API keys (stored locally by the CLI) is proportionate to the stated functionality. Confirm that the CLI is only used for read-only endpoints as advertised; be aware the CLI will have access to whatever credentials you store in ~/.okx/config.toml.

Persistence & Privilege

The skill is not always-enabled and does not request elevated platform privileges. It is user-invocable and allows normal autonomous invocation (default). There is no indication it writes to other skills' configs or requires persistent system-wide changes beyond installing a CLI if you choose to.

What to consider before installing

This skill appears to do what it claims (run the OKX smart-money CLI to fetch leaderboard/signals) but there are two things to check before you proceed: (1) metadata mismatch — the registry info shown earlier said no install/requirements, yet SKILL.md wants the `okx` CLI and an npm package (@okx_ai/okx-trade-cli@1.3.2). Confirm whether the skill actually installs or expects you to install that package. (2) Verify the npm package and publisher: look up @okx_ai/okx-trade-cli on the npm registry and its source repo, review its install scripts, and audit the package (or run in a sandbox) before installing globally. Also: only provide your OKX API keys to the CLI's local config (not in chat), use a profile with read-only or limited permissions if possible, check ~/.okx/config.toml file permissions, and confirm the CLI commands you'll run are read-only as advertised. If you want higher assurance, ask the skill author for the official repository URL and a SHA/signature for the release before installation.

OKX CEX Smart Money CLI

Smart Money leaderboard, trader analytics, position tracking, and aggregated consensus signals.

Preflight

Before running any command, follow ../_shared/preflight.md. Use metadata.version from this file's frontmatter as the reference for Step 2.

Prerequisites

1. Install okx CLI:

   npm install -g @okx_ai/okx-trade-cli
   

2. Configure credentials:

   okx config add-profile AK=<your_api_key> SK=<your_secret_key> PP=<your_passphrase> name=live
   # or interactive wizard:
   okx config init
   

3. Verify: okx --profile live smartmoney traders --limit 5

---

Credential & Profile Check

Run okx config show before any authenticated command.

• Error or no configuration → stop, guide user to run okx config init, wait for completion.
• Credentials configured → proceed.

On 401 errors: stop immediately, tell the user their credentials may be invalid or expired, guide them to update ~/.okx/config.toml (do NOT ask them to paste credentials into chat), then verify with okx config show and retry.

---

Skill Routing

User intent	Route to skill
Market prices, tickers, candles	okx-cex-market
Spot / swap / futures / options orders	okx-cex-trade
Account balance, positions, transfers	okx-cex-portfolio
Grid / DCA trading bots	okx-cex-bot
Simple Earn, On-chain Earn, DCD	okx-cex-earn
Smart Money leaderboard, signals, trader analytics	This skill

---

Command Index (5 commands, all read-only)

Trader Data

Command	Type	Auth	Description
smartmoney traders	READ	Required	List/filter traders from leaderboard
smartmoney trader --authorId <id>	READ	Required	Trader full portrait (profile + positions + trades)
smartmoney overview [--ts <ms>|--dataVersion <ver>]	READ	Required	Multi-currency smart money overview (prefer --ts)

Signal Data

Command	Type	Auth	Description
smartmoney signal [--ts <ms>|--dataVersion <ver>]	READ	Required	Single-currency aggregated consensus signal (prefer --ts)
smartmoney signal-history --instId <id> [--ts <ms>|--dataVersion <ver>]	READ	Required	Signal history timeline for trend analysis (prefer --ts)

Note: Prefer --ts (e.g. --ts $(date +%s)000 for latest snapshot) for overview / signal / signal-history; --dataVersion is an alternative for replaying a prior snapshot. At least one of the two must be provided; if both are sent, --ts wins.

For full command syntax and parameters, read {baseDir}/references/trader-commands.md and {baseDir}/references/signal-commands.md.

---

Operation Flow

Step 0 — Credential & Profile Check

Before any command: see Credential & Profile Check. Always use --profile live silently.

Step 1 — Identify intent

Trader discovery / ranking:

• "推荐交易员" / "top traders" / "牛人榜" → smartmoney traders with sorting/filtering. See {baseDir}/references/trader-commands.md.
• "看看某个交易员" / "trader detail" → smartmoney trader --authorId <id>. See {baseDir}/references/trader-commands.md. Signal analysis:
• "BTC 聪明钱信号" / "smart money signal for BTC" → smartmoney signal. See {baseDir}/references/signal-commands.md.
• "聪明钱总览" / "smart money overview" → smartmoney overview. See {baseDir}/references/signal-commands.md.
• "信号趋势" / "signal trend over time" → smartmoney signal-history. See {baseDir}/references/signal-commands.md.

Step 2 — Execute and present

All commands are READ-only — no confirmation needed. Always pass --json and render results as Markdown tables.

For multi-step workflows (recommend traders then drill down, signal analysis with context), read {baseDir}/references/workflows.md.

---

Global Notes

• Security: Never ask users to paste API keys or secrets into chat.
• Output: Always pass --json to list/query commands and render results as a Markdown table — never paste raw terminal output.
• Network errors: If commands fail with a connection error, prompt user to check VPN: curl -I https://www.okx.com
• Language: Always respond in the user's language.
• Signal availability: Signal commands (overview, signal, signal-history) require either --ts (preferred — use $(date +%s)000 for latest) or --dataVersion (for historical snapshot replay). If both are sent, --ts wins.

For number/time formatting and response structure conventions, read {baseDir}/references/templates.md.