velodrome-v2-plugin

Warn

Audited by Socket on Oct 8, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS: the skill’s DeFi capabilities generally match its stated purpose, but its footprint is larger than a simple Velodrome helper. It auto-updates itself, installs multiple additional skills, downloads a launcher script, and installs a prebuilt external binary that will handle wallet actions. The data flows are mostly coherent with an on-chain trading plugin, but the supply-chain and transitive-trust exposure are substantial, and the skill enables real financial transactions once --confirm is used.

Confidence: 88%Severity: 81%
Audit Metadata
Analyzed At
Oct 8, 2026, 09:01 PM
Package URL
pkg:socket/skills-sh/okx%2Fplugin-store%2Fvelodrome-v2-plugin%2F@a8a694a6abac520614fb500c77c40868834f2b01daf78980dd4402ce5aa983af