okx-growth-competition

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged the literal header value "4d156bf0c61130f2692d097ecb68dbe4" because it is a non-trivial, high-entropy hex string used as an "OK-ACCESS-PROJECT" extra HTTP header in API calls. This looks like a real project/API credential/header token that could grant access if used in requests, so it meets the definition of a secret.

I ignored other candidates as non-secrets:

• Truncated values like "7KRu...", "5abc...", and "0x8e3f..." are partial/redacted or example placeholders and not usable credentials.
• UUID-like "5747d742-..." and other example JSON fields are sample/placeholder values.
• Template placeholders (e.g. "", "", "{supportedChains}") and simple words or canonical examples are documentation placeholders and low-entropy, so not flagged.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly performs on-chain financial actions. The command index documents a competition claim command that performs an "Atomic claim — signs + broadcasts inside the call" (i.e., signs transactions and broadcasts them on-chain). The skill also references trading ("trade for me" delegates to okx-agentic-wallet) and describes reward chains and payouts, which indicate direct crypto transaction capabilities. This is specific, not generic, financial execution authority.