Okx Dex Token

The SKILL.md clearly documents OKX Web3 DEX token endpoints and HMAC auth, which matches the skill name and description. however the registry metadata lists no required environment variables or primary credential, but the instructions explicitly require OKX_API_KEY, OKX_SECRET_KEY, and OKX_PASSPHRASE. That mismatch (metadata claiming no creds vs instructions requiring them) is unexpected and inconsistent.

Instructions are narrowly scoped to calling OKX endpoints and building the HMAC signature; they do not ask the agent to read unrelated system files or exfiltrate arbitrary data. However the provided TypeScript sample falls back to hard-coded 'shared test' API key/secret/passphrase if env vars are not present — this is a dangerous implicit behavior and broadens the effective runtime scope (you may end up using those embedded credentials unintentionally).

This is an instruction-only skill with no install spec and no code files beyond SKILL.md. No downloads or install steps are present, which minimizes install-time risk.

The skill needs API credentials to sign requests (OKX_API_KEY, OKX_SECRET_KEY, OKX_PASSPHRASE) according to SKILL.md, but the registry lists none. Additionally, the sample includes hard-coded secret values (test keys) in the instructions — a poor practice that could cause accidental use of shared credentials or leak if copied. Required env vars are proportionate to the stated goal, but the omission from metadata and the presence of embedded secrets are red flags.

Skill does not request permanent presence (always:false) and does not modify other skills or system settings. It only describes runtime API calls to an external web service.