ZappushZappush
SkillsUse CasesBenchmarkCommunitySign In
      Back to Skills
      ok-james-01

      Safety Report

      Okx Dex Ws

      @ok-james-01

      Use this skill when the user mentions 'onchainos ws', 'ws start', 'ws poll', 'ws stop', 'ws channels', 'ws session', 'ws channel-info', 'idle-timeout', 'idle...

      212Downloads
      0Installs
      0Stars
      4Versions

      Security Analysis

      medium confidence
      Suspicious

      The skill's purpose (managing OKX DEX WebSocket CLI/scripting) is plausible, but its instructions ask the agent to read files from other local skills and describe HMAC auth without declaring any credential or config requirements — an inconsistency you should investigate before installing.

      Apr 29, 20261 files2 concerns
      Purpose & Capabilityok

      Name, description and the SKILL.md content consistently describe WebSocket CLI usage and how to write custom WS clients for OKX DEX channels. The commands, channels, endpoint, and protocol details align with the stated purpose.

      Instruction Scopeconcern

      The runtime instructions explicitly tell the agent to read files outside this skill (e.g., ../okx-agentic-wallet/_shared/preflight.md and ../*/references/ws-protocol.md). The skill manifest declares no config paths or file requirements, so the instructions require access to sibling skill repositories/paths that are not declared — this is a scope mismatch and increases risk because the agent will be instructed to read local files not advertised by the skill.

      Install Mechanismok

      This is an instruction-only skill with no install spec and no code files. That minimizes on-disk installation risk; nothing is downloaded or executed by the install process itself.

      Credentialsconcern

      SKILL.md documents that HMAC-SHA256 authentication is required before subscribing to the WS endpoint, but the skill declares no required environment variables, credentials, or config paths. That mismatch means the skill either expects credentials to be supplied dynamically (via the agent or other skills) or the manifest omitted necessary credential declarations. You should confirm where keys/secrets are stored and whether the agent will access wallet/private keys.

      Persistence & Privilegeok

      The skill is not forced-always, and has no install-time persistence or configuration changes. It does not request system-wide privileges in the manifest.

      Guidance

      This skill is instruction-only and appears to be about managing OKX DEX WebSocket sessions, which is reasonable — but there are a few mismatches you should resolve before installing or invoking it autonomously: - The SKILL.md tells the agent to read relative files from other skills (preflight.md and several ws-protocol.md files). Verify those files exist locally and inspect them yourself: they could contain additional behavior or requests (including credential usage) not visible in this skill. - The protocol requires HMAC-SHA256 login, yet the manifest lists no credentials or config paths. Ask the skill author (or inspect the referenced preflight/protocol files) to confirm how and where the auth keys are provided. Do not allow the agent access to wallet private keys or system secrets unless you explicitly trust the source and have isolated testing safeguards. - Because this skill reads sibling skill files, ensure you trust the whole onchainos-skills collection it ties into. If you cannot verify the referenced files, prefer running the commands manually in a controlled environment or review the referenced files first. If you plan to enable autonomous invocation, be more cautious: autonomous agents can follow the instructions to read local files and perform WS actions. If you want to proceed, check the referenced files and confirm the credential flow (where HMAC keys live) before granting any runtime access.

      Latest Release

      v2.6.0

      - Added workflow hint for related commands: when using `ws start`, `ws poll`, or `ws stop`, users are now prompted to try the **Wallet Monitor (WebSocket)** workflow. - Updated metadata version to 2.6.0. - No changes to CLI usage, parameters, or feature set.

      More by @ok-james-01

      Okx Audit Log

      1 stars

      Okx Growth Competition

      0 stars

      Okx Payments

      0 stars

      Okx Defi Portfolio

      0 stars

      Okx Defi Invest

      0 stars

      Okx Dex Bridge

      0 stars

      Published by @ok-james-01 on ClawHub

      Zappush© 2026 Zappush
      HomeGuaranteeSupport

      Something feels unusual? We want to help: [email protected]