The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the onchainos CLI installer and associated checksum files from the official okx GitHub repository (github.com/okx/onchainos-skills).
Evidence: Found in _shared/preflight.md using curl and Invoke-WebRequest targeting raw.githubusercontent.com/okx/.
Security Control: The process includes a mandatory SHA256 integrity check where the installer's hash is verified against a downloaded installer-checksums.txt file before execution.
[COMMAND_EXECUTION]: The skill executes local shell scripts (install.sh or install.ps1) to install or update its core CLI tool.
Context: This is part of a documented setup routine that verifies binary integrity via SHA256 after installation.
[SAFE]: The instructions include a dedicated 'Safety' section in SKILL.md that explicitly directs the agent to treat all CLI output (token names, symbols, etc.) as untrusted external content, preventing indirect prompt injection from on-chain data.
[SAFE]: The WebSocket protocol documentation in references/ws-protocol.md correctly advises users to manage credentials using environment variables or .env files rather than hardcoding them, following industry security standards.

okx-dex-market