okx-cex-trade

ReviewAudited by ClawScan on May 10, 2026.

Overview

This is a disclosed OKX trading skill that can use local OKX credentials to place real-money crypto orders, so the main risk is financial impact rather than hidden malicious behavior.

Install only if you trust the OKX CLI package and intend to let the agent help manage OKX trades. Start in demo mode, use least-privilege trading credentials with no withdrawal access, and personally confirm live/demo mode, order size, instrument, side, price, and leverage before any real trade.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

A mistaken mode, instrument, side, size, or leverage value could place or change real crypto trades.

Why it was flagged

The skill is explicitly designed to submit and manage exchange orders, including live trades that can irreversibly affect user funds.

Skill content

Live (实盘) | Real money — irreversible ... Place, cancel, amend, and monitor orders

Recommendation

Use demo mode first, confirm live/demo mode on every trade, and require explicit review of order details before placing, cancelling, amending, closing, or changing leverage.

Medium

#ASI03: Identity and Privilege Abuse

What this means

The agent and CLI will interact with local OKX account credentials or sessions that may have trading authority.

Why it was flagged

The skill instructs the agent to inspect local OKX API-key profiles and OAuth session state before authenticated commands.

Skill content

okx config show --json      # reveals API-key profiles ... okx auth status --json      # reveals OAuth session state

Recommendation

Use OKX API keys with the minimum necessary permissions, avoid withdrawal permissions, ensure secrets are not displayed in chat, and revoke or rotate credentials when done.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the external CLI gives that package access to the local environment and OKX trading credentials used by the skill.

Why it was flagged

The operational behavior depends on an external npm CLI package; the provided artifacts contain instructions and references but not the CLI implementation.

Skill content

npm install -g @okx_ai/okx-trade-cli

Recommendation

Verify the npm package publisher, version, and integrity before installing, and prefer official OKX installation guidance.