okx-dex-bridge

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's preflight steps instruct the agent to curl and download installer scripts/checksums from GitHub and raw.githubusercontent.com at runtime (e.g. https://raw.githubusercontent.com/okx/onchainos-skills/${LATEST_TAG}/install.sh) and then execute them, which fetches and runs remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly for executing cryptocurrency cross-chain swaps. It defines specific commands that build and broadcast transactions (e.g., onchainos cross-chain approve, onchainos cross-chain swap, onchainos cross-chain execute) and includes user-confirmation gates for broadcasting, approvals, and force flags. Those are direct financial execution capabilities (constructing, approving, and broadcasting on-chain transfers), not generic tooling.