okx-cex-portfolio

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill references an external npm package (@okx_ai/okx-trade-cli@1.4.6) and includes instructions to install it via npm install -g @okx_ai/okx-trade-cli, which constitutes an unverifiable runtime external dependency from an unofficial/unknown package source.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill documents account-level asset transfers (okx account transfer) between funding and trading accounts, which constitutes a direct financial operation (transferring funds/assets). Although the CLI requires API credentials or OAuth login configured via okx config init, the prompt states that credentials alone (API keys/OAuth sessions) do not constitute independent access control enforced by the execution layer for a direct financial operation without external approval/confirmation steps at execution time. Therefore, the direct transfer operation lacks qualifying independent access control.