meteora-plugin

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill's documented setup instructions pull installation scripts and release binaries directly from arbitrary GitHub raw and release download URLs (github.com/okx/onchainos-skills and github.com/okx/plugin-store) without cryptographic pinning or official repository verification.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill operates a Solana DEX plugin capable of executing token swaps, adding liquidity, and removing liquidity via on-chain transactions (swap, add-liquidity, remove-liquidity). These operations constitute direct financial actions (trades/purchases/transfers). Although the instructions describe confirmation protocols and preview modes, these are agent-side guidelines and instructions rather than independent access controls enforced by the underlying service or execution layer. Consequently, the direct financial operations lack independent qualifying access control.