okx-cex-smartmoney

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill directs running okx config show --json to detect non-empty api_key profiles and requires rendering JSON outputs as Markdown tables, but gives no guidance to redact secrets, which creates a real risk the agent must read and could output API key values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly fetches live, public OKX smart-money and trader data (user-generated nicknames, positions, orders) via CLI commands like "okx smartmoney traders-by-filter" and "okx smartmoney signal-overview-by-filter" as described in SKILL.md and references/workflows.md, and the agent is expected to read and act on that data (e.g., recommend traders, fan-out follow-up commands), so untrusted third-party content can materially influence behavior.