okx-outcomes

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs agents/users at runtime to run a remote install script that is fetched and executed via curl (curl -fsSL https://raw.githubusercontent.com/okx/outcomes-cli/main/install.sh | sh), which downloads and runs remote code required to provide the okx-outcomes binary.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly exposes trading and on-chain write commands (e.g., clob create-order, market-order, cancel-*, ctf split/merge/redeem) and requires a signing key / wallet binding for execution. It also documents examples of placing orders and reporting order ids / tx hashes. These are direct crypto/market order execution capabilities (moving value / creating orders), so this is Direct Financial Execution.