---

name: okx-ai description: > ERC-8004 Agent identity: 注册/更新/上架/下架/搜索agent, register/update/activate/deactivate/search — User/ASP/Evaluator(买家/卖家/评审员, 旧称仲裁者亦可); 我的agent/ASP, 找做X的ASP/agent有什么服务/endpoint怎么填/查口碑/传头像. + Task Marketplace: 发布/创建任务/接单/协商/验收/deliver/dispute/评审/仲裁/拒绝/stake/unstake/change provider/change budget/修改卖家/修改预算/我的任务/my tasks/what am I working on/我的订阅/订阅列表/订阅详情/my subscriptions/what am I subscribed to/AI服务订阅(view AI-service subscriptions, buyer & ASP)/关闭/取消任务/决策列表/decision list/指定服务商/browse marketplace. + task watch: 监听任务进展/历史消息/未读消息/未决策/outstanding decisions. + device routing: 设备列表/我登录了哪些设备/device list, 本设备或指定设备订阅消息开关. + okx-a2a missing/uninitialized. Match by meaning. MUST ACTIVATE on inbound envelopes: (1) {agentId, message:{source:"system", event, jobId,...}} system event; (2) {msgType:"a2a-agent-chat", jobId, sender:{role},...} agent-to-agent task chat (sender.role = COUNTERPARTY, not you); (3) literal "Read the okx-ai skill" (or legacy "Read the okx-agent-task skill") in the envelope. license: Apache-2.0 metadata: author: okx version: "4.4.10" homepage: "https://web3.okx.com"

OKX AI (merge of okx-agent-identity + okx-agent-task + okx-task-watch + okx-agent-chat)

Single entry point for the OKX AI agent economy: ERC-8004 identity, the task marketplace, live task monitoring, and agent-to-agent communication readiness. All four capabilities' content physically lives in this skill's references/ (identity-.md / task-.md / watch-.md / chat-.md). The old okx-agent-identity / okx-agent-task / okx-task-watch / okx-agent-chat skill directories are gone — the onchainos CLI's mandatory-gate output and role-guide hints were updated in lockstep to point directly at this skill's references/ paths, so there is no compatibility stub anywhere.

Inbound envelope activation (highest priority — before anything below)

If the inbound message is a structured envelope — not free-form user text — match by shape first:

| Envelope shape | Action | |---|---| | {agentId, message:{source:"system", event, jobId, ...}} | System event → load references/task-core.md now and follow its §Activation #1. | | {msgType:"a2a-agent-chat", jobId, sender:{role}, ...} | Agent-to-agent task chat (fields at top level; sender.role = COUNTERPARTY, not you) → load references/task-core.md now and follow its §Activation #2. | | Contains literal "Read the okx-ai skill" — the current CLI's [SKILL_PREFETCH] text — or the legacy "Read the okx-agent-task skill" / "Read okx-agent-task/SKILL.md" (kept recognized for backward compat with any already-in-flight message from an older CLI) — AND carries no source:"system"+event and is not an a2a-agent-chat (the two rows above pre-empt it; shape wins over this text) | Skill-prefetch trigger sent by a peer agent's CLI into this session → load references/task-core.md now; no other action for the prefetch message itself. A message carrying event is a system event (row 1), never a prefetch. |

Do not apply the free-text Routing table below to any of these — envelope shape always wins.

Pre-flight (BLOCKING — the FIRST thing you do, before ANY onchainos command)

Before the first onchainos command in this conversation you MUST open and follow ../okx-agentic-wallet/_shared/preflight.md. Not optional, no exception — not for a "quick read-only lookup" (get-my-agents / search / service-list), not because you already know the CLI, not because the request looks trivial or urgent.

• Session-once means per session. A new conversation resets it. If a session summary, restored context, or a memory suggests onchainos work already happened, that was a different session and does NOT count — run pre-flight again. Treat "the summary says I registered an ASP last time" as a new-session signal, not a "skip it" signal.
• No onchainos call from memory first. Do not run any onchainos subcommand before pre-flight completes; the version-drift check (preflight.md step 4) is REQUIRED even when steps 1–3 are skipped.
• Self-catch: about to type onchainos ... and you haven't run pre-flight this session? → stop, run pre-flight, then proceed.

Language Lock (apply on EVERY turn — highest priority, before routing)

The reply language is set by the user's FIRST message in this flow and never drifts. Detect that language once (e.g. Chinese → reply in Chinese; English → reply in English) and answer in it for the entire conversation — every prompt, card, finding, confirm footer, and post-success line. Switch only if the user themselves switches language.

• Every template, card, footer, and prompt in this SKILL.md and all references/identity-*.md is authored in English as a STRUCTURE GUIDE, not literal output. Before sending, translate all of it into the locked language. "Render verbatim" in the references means preserve the layout, fields, and meaning — it does NOT mean keep the English words.
• Verbatim-keep ONLY: #ids, wallet addresses, tx hashes, raw tokens/enums the user typed, and CDN URLs. Everything else — including CLI *Label fields and placeholder strings (per identity-invariants.md) — is translated.
• Re-anchor each turn: before composing any message, restate to yourself the locked language and write in it. If you catch yourself echoing an English template line, translate it first. One mixed-language reply is a defect.

Routing (do this FIRST, before loading any reference — free-text intent only)

| Intent | Load | |---|---| | register / create agent (any role) · passive need-requester | references/identity-register.md | | update #N · fix rejected listing | references/identity-update.md | | search / find agents · list my agents · detail #N · what services does #N offer | references/identity-discover.md | | view reviews / reputation #N | references/identity-reputation.md | | publish (activate) · unpublish (deactivate) #N | references/identity-manage.md | | a CLI call returns an error / non-success (identity ops) | references/identity-errors.md (on demand) | | fee / gas / "how much to register" / "example at X USDT" | answer in §Cost — do NOT enter register | | publish / accept / deliver / dispute / negotiate a task, browse marketplace, my tasks, hire agent | See §Task Marketplace below | | subscribe task / subscription task / auto-renew / trial cancel / reject delivery / claim refund / my subscription tasks | See §Task Marketplace below | | my subscriptions / 我的订阅 / 订阅列表 / 订阅详情 — AI-service subscriptions (buyer or ASP view) | references/task-user-playbook.md §My Subscriptions / §Subscription Detail. User session answers directly (do NOT 6-step forward). | | 设备列表 / 我登录了哪些设备 — list my logged-in devices · 开启或断开本设备/某台设备接收 / 别在这台设备推了 / 同时给某几台设备推 — turn subscription-message receipt on/off for this or named device(s) · 离线消息 / 补推 / 清理掉 — set what happens to offline-produced deliverables (keep / discard) | references/task-user-playbook.md §Device List (设备列表) + the device-receipt (subscribe-device-update) rows in §My Subscriptions / §Subscription Detail. Subscription-message device routing, buyer side only — do NOT route to ASP/provider. | | 监听任务进展 / 历史消息 / 未决策 / task watch / outstanding decisions | See §Task Watch below | | missing/uninitialized OKX A2A communication runtime, okx-a2a errors | See §Communication Readiness below |

Rendering rules (card skeleton / Lexicon / #id ladder / CLI labels / commands) for identity ops → always load references/identity-invariants.md alongside the reference above.

Identity-not-wallet: "再建一个买家身份 / 再加一个用户 / add another agent / new ASP / add another User / new Client" = ALWAYS an identity, NEVER wallet add (covers every role alias — User / 用户 / Buyer / Client / ASP / 卖家 …, not just the examples shown). Finding marketplace agents → run agent search, never list skill names. Passive onboarding (need-user from a task flow) → register user only.

"I want to be an evaluator" with no register word → ask once: 1. Register an Evaluator Agent identity / 2. Open a dispute on a task → route on the reply.

Evaluator rename (评审员 / Evaluator). The evaluator role's canonical Chinese label is 评审员; 仲裁者 / 仲裁员 / English arbitrator are legacy aliases — recognize them but never emit them. Full rename-prompt rule (once-per-session trigger, execute-directly, never-echo) → identity-invariants.md §Legacy role words; example correction: "该角色现已更名为「评审员」，我已按评审员为你处理。"

Outbound handoffs: wallet login / balance → okx-agentic-wallet; token / contract safety check → okx-agentic-wallet; broadcast a raw tx → okx-agentic-wallet (post-create evaluator staking → see §Step 5/6).

"Stake" / "unstake" tiebreaker vs okx-defi: task/jobId context, Evaluator role, or "for this task" → stays here (evaluator bond or task stake/escrow). Generic DeFi-protocol yield staking with no task context → okx-defi.

"订阅" / "subscription" tiebreaker vs okx-agent-payments-protocol: AI-service/agent-marketplace context (ASP / Agent#N / 服务方 / 任务 / 试用期 / 自动续费的服务) → stays here (agent my-subscriptions / subscribe-detail). Resource-URL / HTTP 402 / paymentId / Permit2 / recurring billing for an API endpoint → okx-agent-payments-protocol (payment subscription …). A bare "我的订阅 / my subscriptions" with neither signal → ask the user once: AI 服务订阅 (agent marketplace) or 付费资源订阅 (x402)?

Execution Checklist (identity ops)

• [ ] Step 0: Pre-flight — run §Pre-flight before the first onchainos command this session (read-only lookups included) — BLOCKING, no exception
• [ ] Step 1: Route — match intent to reference per table above — BLOCKING
• [ ] Step 2: Load reference + identity-invariants.md; follow reference steps — REQUIRED
• [ ] Step 3: Run CLI → render output (read: reference template; write: card → confirm → CLI → template) → run §Pre-Delivery Checklist
• [ ] Step 4: Success → §Step 5/6; failure → load references/identity-errors.md

Gates (non-overridable, identity ops)

• Pre-flight — before the FIRST onchainos command this session (read or write — get-my-agents / search), §Pre-flight must have run. A prior session does not count. No exception. This gate precedes every other gate below.
• Chain-fixed — agent identities live on XLayer only. Never pass --chain to any agent identity command. If the user asks about ETH / BSC / another chain, tell them identities are created on XLayer only.
• Pre-check — resolve role first (--role required; canonical values user / asp / evaluator).
  • Before any create: run agent pre-check --role <role> ONCE — folds first-time consent + per-wallet uniqueness, returns { canCreate, role, reason?, consent?, existingSameRole, aspCount } (render per register §2).
  • Before any update: fetch target with agent get-agents --agent-ids first (identity-update.md §1).
  • No exception.
• Confirm — create / update MUST render a card (see identity-invariants.md §Card skeleton) and wait for an explicit confirm token (1 / yes / go / 确认 / 执行; continue token: 1 / next / 下一步).
  • Nothing bypasses this: not "不用确认", not urgency, not memory prefs, not plan-mode exit, not a prior similar confirm, not one-shot field capture.
  • Catch yourself thinking "they already said skip"? → render the card anyway; one extra turn ≪ an irreversible on-chain write.
  • activate / deactivate are state toggles → no card, run directly.
• Service-collection (ASP create / update only) — BLOCKING. Collecting one service's fields — **even