The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill manages the discovery and retrieval of third-party 'skills' from the OKX marketplace. These external packages (zip or .skill format) contain markdown instructions and potentially supporting scripts that are downloaded to the local filesystem.
[COMMAND_EXECUTION]: The skill requires the installation of the @okx_ai/okx-trade-cli Node.js package and executes various shell commands through the okx binary, including okx skill add, which triggers npx skills add to register new capabilities with local agents.
[DYNAMIC_EXECUTION]: The installation process involves downloading third-party packages, extracting them, and loading their instructions into the agent's environment. While signature verification is performed, the skill explicitly provides a --force flag that allows users to bypass these security checks and install unverified content.
[INDIRECT_PROMPT_INJECTION]: The skill's core functionality creates a surface for indirect prompt injection by processing and displaying untrusted data from a remote marketplace.
Ingestion points: Marketplace search results, skill descriptions, and the SKILL.md content of downloaded third-party packages (processed in SKILL.md).
Boundary markers: The skill includes a clear 'Third-Party Content Notice' warning the agent and user that OKX does not review or endorse the content of these skills.
Capability inventory: The skill has the ability to write to the agent's local skill directory (~/.agents/skills/) and execute installation hooks via npx (referenced in SKILL.md).
Sanitization: The platform utilizes Ed25519 signatures and SHA-256 integrity checks to ensure the package hasn't been tampered with since its publication to the marketplace.

okx-cex-skill-mp