okx-mcp-skill

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill prompt includes an explicit trial API key literal and instructs the agent to pass it directly via a CLI flag (--secret), as well as encouraging environment variables or secret managers for production use, but embedding a real API key directly in documentation and command examples is an insecure credential handling pattern.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill provides access to OKX DEX swap and approval operations (dex-okx-dex-swap, dex-okx-dex-approve-transaction, dex-okx-dex-solana-swap-instruction), which constitute direct financial operations (trades/swaps and settlement authorization). These operations are authenticated via API keys (OK-ACCESS-KEY), satisfying independent service-layer authentication requirements.