The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The instructions in SKILL.md and the install.sh script recommend installing the OKX CLI by downloading a shell script and piping it directly to bash: curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | bash. This pattern allows for the execution of arbitrary remote code without verification of the script content.
[COMMAND_EXECUTION]: The skill and its accompanying references/integration-patterns.md file contain multiple instances of calling external binaries using child_process.execFileSync. It specifically targets the onchainos CLI to perform actions like swaps, token discovery, and price queries. This creates a risk of command injection if parameters passed to the CLI are not properly sanitized.
[EXTERNAL_DOWNLOADS]: The skill has significant external dependencies, requiring the user to install the helius-mcp server via npx and the onchainos-skills library. These components are fetched from remote registries and repositories at runtime.
[DATA_EXFILTRATION]: The skill requires the configuration of several sensitive API keys (HELIUS_API_KEY, OKX_API_KEY, OKX_SECRET_KEY, OKX_PASSPHRASE) as environment variables. While standard for operation, the integration patterns include sending data to external endpoints such as https://sender.helius-rpc.com/fast and Helius RPC URLs.

helius-okx