Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add okx/agent-trade-kit --skill okx-cex-authgit clone --depth 1 https://github.com/okx/agent-trade-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/okx/agent-trade-kit/okx-cex-auth)<a href="https://agentmods.dev/skills/okx/agent-trade-kit/okx-cex-auth"><img src="https://agentmods.dev/badge/skills/okx/agent-trade-kit/okx-cex-auth.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 194 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- medium Excessive Agency · line 298 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00228 | $0.04553 |
| Opus 5 | $0.00114 | $0.02277 |
| Sonnet 5 | $0.00046 | $0.00911 |
| Haiku 4.5 | $0.00023 | $0.00455 |
Grade A, and why
okx-cex-auth scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
3 near-identical copies found in the catalogue:
- okx-cex-auth — 100% identical, 0 lines differ
- okx-cex-auth — 97% identical, 17 lines differ
- okx-cex-auth — 97% identical, 17 lines differ
How it starts
The opening of the file, as written. The whole thing — 331 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OKX CEX Authentication
OAuth 2.0 device flow authentication for OKX CLI. Guides first-time setup, re-authentication after session expiry, and logout.
Supported Sites
| Site | Region | URL |
|---|---|---|
global |
Global | www.okx.com |
eea |
EEA | my.okx.com |
us |
US | app.okx.com |
tr |
TR | tr.okx.com |
Site is a separate dimension from auth method. Both API-key and OAuth paths require a site. Once selected, a site is persisted:
- API-key users:
profile.sitein~/.okx/config.toml(written byokx config init). - OAuth users: saved inside the
okx-authbinary state the first timeokx auth login --site <X>succeeds, and returned byokx auth status --jsonas thesitefield.
There is no okx config set-site command — site cannot be persisted independently of an auth attempt. For OAuth flows, the agent must remember the user's choice within the conversation and pass --site <X> on okx auth login.
Prerequisites
Install okx CLI if not already installed:
npm install -g @okx_ai/okx-trade-cli
Step 0: Pre-flight Check (MANDATORY)
Unconditional rule — do NOT skip Step 0 under any circumstances. Even if a prior skill (preflight, okx-cex-portfolio, etc.) already ran auth status and passed you a conclusion like "user is not_logged_in, go log in" — you MUST re-run the two commands below yourself and walk Steps 0.1 → 0.2 → 0.3 in order. Upstream tool output does not substitute for your own pre-flight. The single most common failure mode for this skill is an agent that reads an upstream "not authenticated" signal, skips Step 0.1 site selection, and calls okx auth login with a silently-defaulted site.
Run both in parallel:
okx config show --json
okx auth status --json
Then apply the following three checks in strict order — each step short-circuits the rest.
Step 0.1 — Site check (independent of auth mode)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed a0de361ae12b
- 4d ago Changed 3f2e9ac3aad1
- 8d ago First seen · 331 lines · 228 tokens per session scan A c4f16c49e766
okx-cex-auth is a skill published in the GitHub repository okx/agent-trade-kit (420 stars, last pushed today), licensed MIT. It adds 228 tokens to every session and 4,553 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
add-export
Add a new subpath export to the @cyanheads/mcp-ts-core package. Use when creating a new public API surface that consumers import from a dedicated subpath (e.g., @cyanheads/mcp-ts-core/newutil).
fluent-development
This skill should be used when the user asks to "build a fluent app", "create a servicenow app in typescript", or mentions "servicenow sdk", "now-sdk", "fluent", "scoped app as code", or "pro-code development" — or when the working directory contains a now.config.json or .now.ts files.
webmcp-add-tool
Scaffolds a new WebMCP tool component using useMcpTool with Zod schema, handler, annotations, and wires it into the WebMCPProvider tree. Use when the user wants to expose functionality as an MCP tool, make something callable by AI, add a new tool, or create an AI-accessible action.
webmcp-setup
Bootstraps webmcp-react into an existing React or Next.js app. Installs dependencies, adds WebMCPProvider, creates a first tool, and configures the MCP client bridge. Use when the user wants to set up WebMCP, add MCP tools to their app, integrate webmcp-react, or make their React app accessible to AI agents.
add-mechanic
Add game mechanics with correct GDScript 4.x patterns -- movement, health, inventory, save/load.
create-document
A tool for creating and posting documents in 1C, a business software system commonly used for accounting and operations. It checks the available document types and fields before writing data.