Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Okx Defi Portfolio

v2.2.10

Use this skill to 'check my DeFi positions', 'view DeFi holdings', 'show my DeFi portfolio', 'what DeFi am I invested in', 'show my staking positions', 'show...

0· 122·0 current·0 all-time
Security Scan
Capability signals
CryptoRequires walletRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name and description (viewing DeFi positions/holdings) align with the instructions which call the onchainos CLI to fetch positions and details. However, the SKILL.md repeatedly instructs the agent to run onchainos commands (wallet status/addresses, defi positions/position-detail) but the skill metadata lists no required binaries. The implicit dependency on the onchainos CLI (or equivalent agentic-wallet integration) is expected for this purpose but should have been declared.
Instruction Scope
Instructions are narrowly scoped to resolving an address (via the Agentic Wallet) and running the onchainos defi queries. They do not ask to read arbitrary files, environment variables, or transmit data to unexpected external endpoints. The skill explicitly forbids deposit/redeem/claim actions and directs users to other skills for those operations.
Install Mechanism
No install spec or code is present (instruction-only), so nothing is written to disk. This reduces attack surface. The guidance assumes existing on-chain tooling (onchainos) is available, which is an implicit requirement rather than an installed artifact.
Credentials
The skill declares no environment variables or credentials. However, it instructs the agent to access the Agentic Wallet (wallet status, wallet addresses, account switching) to resolve addresses automatically. Access to wallet addresses (and account lists) is sensitive but proportionate for a portfolio-viewing skill; the SKILL.md does not declare this access in metadata and does not request explicit permission beyond 'confirm the resolved address with the user'.
Persistence & Privilege
The skill does not request always: true and has no install behavior. It does not modify other skills' configuration or claim permanent presence; autonomous invocation is allowed (default) but not combined with other high-risk factors here.
What to consider before installing
This skill appears to be a read-only DeFi portfolio viewer that uses the onchainos CLI / OKX agentic wallet to resolve addresses and query positions. Things to consider before installing: - The SKILL.md expects the onchainos CLI (or equivalent agent tooling) to be available and instructs running commands like `onchainos wallet status`, `onchainos wallet addresses`, and `onchainos defi positions`, but the skill metadata does not declare that binary as a required dependency. Confirm you have and trust the onchainos tooling the skill will call. - The skill will automatically attempt to read your Agentic Wallet addresses (and may iterate over multiple account IDs if you ask it to check "all accounts"). That is necessary for its purpose but is sensitive. If you prefer, provide wallet addresses manually when invoking the skill rather than letting it resolve them automatically. - There is no install step or bundled code (lower surface area), and the instructions explicitly limit actions to viewing positions (not deposits/claims). Still, because the skill can access your wallet addresses, only enable it if you trust the environment that manages your Agentic Wallet and the onchainos tooling. If you want higher assurance, ask the skill author to: declare the onchainos CLI as a required binary, explicitly document what wallet data will be accessed, and optionally require explicit user consent before enumerating multiple accounts.

Like a lobster shell, security has layers — review code before you run it.

latestvk9701nsyrfzcrsznjxybq4btws84yh0h
122downloads
0stars
2versions
Updated 3d ago
v2.2.10
MIT-0

OKX DeFi Portfolio

2 commands for viewing DeFi positions and holdings across protocols and chains.

Skill Routing

  • For DeFi deposit/redeem/claim → use okx-defi-invest
  • For token price/chart → use okx-dex-market
  • For wallet token balances → use okx-wallet-portfolio
  • For DEX spot swap → use okx-dex-swap

Quickstart

# Get DeFi holdings overview across chains
onchainos defi positions \
  --address 0xYourWallet \
  --chains ethereum,bsc,solana

# Get detailed holdings for a specific protocol (analysisPlatformId from positions output)
onchainos defi position-detail \
  --address 0xYourWallet \
  --chain ethereum \
  --platform-id 67890

Command Index

#CommandDescription
1onchainos defi support-chainsGet supported chains for DeFi
2onchainos defi support-platformsGet supported platforms for DeFi
3onchainos defi positions --address <addr> --chains <chains>Get user DeFi holdings overview
4onchainos defi position-detail --address <addr> --chain <chain> --platform-id <id>Get detailed holdings for a protocol

Chain Support

ChainName / AliaseschainIndex
Ethereumethereum, eth1
BSCbsc, bnb56
Polygonpolygon, matic137
Arbitrumarbitrum, arb42161
Basebase8453
X Layerxlayer, okb196
Avalancheavalanche, avax43114
Optimismoptimism, op10
Fantomfantom, ftm250
Suisui784
Trontron, trx195
TONton607
Linealinea59144
Scrollscroll534352
zkSynczksync324
Solanasolana, sol501

Operation Flow

Step 0: Address Resolution

When the user does NOT provide a wallet address, resolve it automatically from the Agentic Wallet before running any defi command:

1. onchainos wallet status          → check if logged in, get active account
2. onchainos wallet addresses       → get addresses grouped by chain category:
                                       - XLayer addresses
                                       - EVM addresses (Ethereum, BSC, Polygon, etc.)
                                       - Solana addresses
3. Match address to target chain:
   - EVM chains → use EVM address
   - Solana     → use Solana address
   - XLayer     → use XLayer address

Rules:

  • If the user provides an explicit address, use it directly — skip this step
  • If wallet is not logged in, ask the user to log in first (→ okx-agentic-wallet) or provide an address manually
  • If the user says "check all accounts" or "all wallets", use wallet balance --all to get all account IDs, then wallet switch <id> + wallet addresses for each account, and query positions for each
  • Always confirm the resolved address with the user before proceeding if the account has multiple addresses of the same type

Step 1: Identify Intent

User saysAction
View positions / portfolio / holdingsonchainos defi positions
View detail for a protocolonchainos defi position-detail
Redeem / claim after viewingSuggest → use okx-defi-invest

Step 2: Collect Parameters

  • Missing wallet address → resolve via Step 0 (wallet status → wallet addresses), or ask user if not logged in
  • Missing chains → ask user which chains to query, or suggest common ones (ethereum, bsc, solana)
  • Missing platform-id → run defi positions first to get analysisPlatformId

Step 3: Display Results

Displaying Positions Results

When displaying defi positions output, you MUST use exactly these columns in this order — no substitutions, no omissions:

#PlatformanalysisPlatformIdChainsPositionsValue(USD)
1Aave V312345ETH,BSC2$120.00

Rules:

  • analysisPlatformId is MANDATORY in every row — users must copy this value to run position-detail
  • Never omit, hide, or replace analysisPlatformId with any other field
  • Never group platforms — show every platform as its own row regardless of value size
  • Raw JSON path: walletIdPlatformList[*].platformList[*] — each element is one platform row
    • platformName → Platform
    • analysisPlatformId → analysisPlatformId
    • networkBalanceList[*].network → Chains (join with comma)
    • investmentCount → Positions
    • currencyAmount → Value(USD)

Displaying Position Detail Results

Output shape: { "ok": true, "data": [ { "walletIdPlatformDetailList": [...] }, ... ] }data is an array. Never call .get() on data directly; iterate over it as a list.

When displaying defi position-detail output, render all tokens in a single flat table with these exact columns:

TypeAssetAmountValue(USD)investmentIdaggregateProductIdToken ContractRewards
SupplyUSDT1.002285$1.0025127719310x970223...70.000080 AVAX
PendingsAVAX0.00000091$0.000012Platform reward

Rules:

  • Each token row is one row; merge in investmentId and aggregateProductId from its parent investment entry
  • investmentId is MANDATORY in every row — users need it for redeem/claim (via okx-defi-invest)
  • aggregateProductId — show if present, otherwise
  • Token Contract: show the full contract address without truncation; show if native/empty
  • Rewards: show pending reward amount + symbol if present, if none; for platform rewards show Platform reward
  • Type: map investType → Supply/Borrow/Stake/Farm/Pool etc; pending rewards row uses Pending
  • Health rate: show separately below the table with warning if healthRate < 1.5

V3 Pool Positions — Extra Fields

For V3 Pool positions (positionList present), show an additional section per position:

tokenIdStatusRangetickLowertickUpper
93828ACTIVE0.892 – 0.992 USDC/DAI-33500-30450
  • tokenId: from positionList[].tokenId
  • positionStatus: ACTIVE or INACTIVE
  • range: from positionList[].range
  • tickLower / tickUpper: from positionList[].rangeInfo.tickLower / rangeInfo.tickUpper
  • These fields are critical for V3 operations (add liquidity, withdraw, collect V3 fees)

investType Reference

investTypeDescription
1Save (savings/yield)
2Pool (liquidity pool)
3Farm (yield farming)
4Vaults
5Stake
6Borrow
7Staking
8Locked
9Deposit
10Vesting

Post-execution Suggestions

Just completedSuggest
defi positions1. View detail → defi position-detail 2. Redeem → okx-defi-invest 3. Claim rewards → okx-defi-invest
defi position-detail1. Redeem position → use okx-defi-invest with investmentId from table 2. Claim rewards → use okx-defi-invest 3. Add more → use okx-defi-invest
defi position-detail (V3 Pool)1. View depth chart → defi depth-price-chart --investment-id <id> (via okx-defi-invest) 2. View price history → defi depth-price-chart --investment-id <id> --chart-type PRICE

Global Notes

  • CRITICAL — Address-chain compatibility: The --address and --chains parameters must be compatible. EVM addresses (0x…) can only query EVM chains; Solana addresses (base58) can only query solana. Never mix them in a single call — the API will return error 84019 (Address format error).
    • 0x… address → only pass EVM chains: ethereum,bsc,polygon,arbitrum,base,xlayer,avalanche,optimism,fantom,linea,scroll,zksync
    • base58 address → only pass solana
    • Sui address → only pass sui
    • Tron address (T…) → only pass tron
    • TON address → only pass ton
    • If the user wants positions across both EVM and Solana, make two separate calls with the respective addresses
  • defi positions uses --chains (plural, comma-separated, e.g. --chains ethereum,bsc) — do NOT use --chain
  • defi position-detail uses --chain (singular) — do NOT use --chains
  • The wallet address parameter is --address for both commands
  • position-detail requires analysisPlatformId from positions output as --platform-id
  • The CLI resolves chain names automatically (ethereum1, bsc56, solana501)

Comments

Loading comments...