okx-dapp-discovery

SUSPICIOUS. The stated purpose matches the behavior, but the skill's main function is transitive skill installation and delegation into newly fetched plugin instructions. Install sources are partly verifiable and not obviously malicious, yet the runtime trust expansion and global auto-install behavior make the overall risk medium-high even without direct credential theft evidence.