okx-cex-smartmoney

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow fetches trader profile nicknames, search keywords, and order/position records from the OKX Smart Money API, which represent user-contributed or trader-supplied display names and text inputs read by the agent at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The skill installs an npm package (@okx_ai/okx-trade-cli) from the public npm registry, which is a common/reputable unofficial dependency path (transporter, but third-party publisher provenance).