okx-account

SUSPICIOUS. The skill’s stated purpose and requested read-only OKX credentials are proportionate, and the OKX/PyPI/GitHub references look legitimate. The main inconsistency is the required internal HTTP proxy, which places a non-OKX intermediary in the credential and data path; without code or proxy ownership assurances, that weakens data-flow integrity enough to classify the skill as suspicious rather than benign.

The code is primarily a read-only OKX account reporting tool. It does not contain evident malware, destructive behavior, dynamic code execution, or unauthorized trading actions. Security concerns are the hardcoded authenticated proxy, routing API-client traffic through that proxy, loading secrets from a fixed .env path, and printing highly sensitive account data to stdout. The proxy and credential handling should be reviewed and replaced with securely managed, verified configuration.

The visible code is a read-only OKX reporting CLI, not an obvious malware payload. It does transmit sensitive API-authenticated requests and financial account data through a hardcoded credential-bearing proxy, which is a significant security and privacy concern if that proxy is not trusted. No direct destructive or mutating operation is shown. Review the proxy ownership, rotate/remove embedded proxy credentials, secure the dotenv file, and inspect the imported OKX SDK before use.