Aerodrome AMM

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's pre-flight install steps perform runtime downloads and execution of remote installers/binaries (notably the onchainos installer fetched and executed from https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.sh and plugin binaries from https://github.com/okx/plugin-store/releases/download/$TAG/), so remote content is fetched during runtime and executed as a required dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a blockchain trading plugin that builds, signs, and broadcasts on-chain transactions to move crypto assets. It exposes concrete commands for financial execution: swap, add-liquidity, remove-liquidity, claim-fees, approvals, positions, and uses onchainos wallet operations (including contract-call and wallet balance/address checks). The docs describe preview vs. execute flows with a --confirm flag, dry-run/unsigned-tx handling, and a Live Trading Confirmation Protocol that governs signing/broadcasting. This is specifically designed to perform crypto transactions and manage assets on-chain (not a generic tool), so it grants direct financial execution capability.