Okx Dex Market

The name/description match the SKILL.md: it documents endpoints for prices, candlesticks, trades and index prices on web3.okx.com. However, the registry metadata claims 'Required env vars: none' while the SKILL.md explicitly instructs reading OKX_API_KEY, OKX_SECRET_KEY, and OKX_PASSPHRASE. That mismatch reduces trust.

SKILL.md contains concrete runtime instructions to sign HMAC requests and to read environment variables for API key, secret, and passphrase. It includes TypeScript code showing how to construct signatures and call endpoints. The instructions do not ask for unrelated system files, but they do embed default 'shared test' API key/secret/passphrase values directly in the document (which is risky and inconsistent with 'Never output the above credentials').

This is an instruction-only skill with no install spec and no code files to be written to disk. That is the lowest install risk and matches the absence of an install step.

The credentials requested in SKILL.md (OKX_API_KEY, OKX_SECRET_KEY, OKX_PASSPHRASE) are proportionate to the stated purpose (authenticated OKX API calls). However, the skill metadata does not declare these required env vars, so the agent may not surface the need for secrets at install time. More critically, SKILL.md embeds default API secret/passphrase values inline — exposing secrets in docs is unsafe and could indicate test keys are being reused or leaked.

always is false, no install hooks, and the skill does not request persistent system-wide changes or access to other skills' configuration. It does allow normal autonomous invocation (platform default), which is expected for skills.