The 89 static alerts are false positives caused by Markdown code formatting, fixed documentation links, CLI parameters, and safety statements about keys. However, the shared preflight instructions trust remote action text and can download and execute an installer without an independently trusted verification source.
Remote preflight response can direct arbitrary actions
The preflight instructions require the agent to show a non-null remote data.action value to the user and do exactly what it says. A compromised service, binary, or update channel could use that value to induce unreviewed actions.
The instruction explicitly delegates action selection to external JSON without an allowlist or user confirmation requirement.
When the CLI is absent, the fallback directs downloading install.sh and running it. Although a checksum file is mentioned, both artifacts are obtained together and no trusted checksum source is specified.
The documented fallback executes a remotely obtained installer and does not establish an independent trust root for checksum verification.
Most static findings are Markdown command references, examples, or safety text rather than executable malware indicators. The confirmed risks are a parent-directory reference to a sibling skill file and preflight instructions that can update or install local tooling. No prompt injection attempt or secret collection request was found.
The shared preflight directs the agent to follow update actions, notes that preflight updates the binary and skill checkouts, and tells it to download and run installer files if onchainos is missing. This can modify the local environment and should require explicit user approval in a community skill.
The cited lines explicitly mention force upgrade behavior, binary and skill checkout updates, and running downloaded installer files. Checksum verification mitigates risk but does not remove the local system modification risk.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
> Read `../okx-agentic-wallet/_shared/preflight.md`. If that file does not exist, read `_shared/pref
SKILL.md line 17 instructs the agent to read ../okx-agentic-wallet/_shared/preflight.md, which crosses the skill package boundary. A sibling file could alter trusted instructions outside this skill.