[new-plugin] pancakeswap-clmm v0.1.0#172
Conversation
skylavis-sky
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
Phase 4: Summary + Pre-flight for
|
| Command | Description |
|---|---|
farm --token-id <ID> |
Stake LP NFT into MasterChefV3 to earn CAKE |
unfarm --token-id <ID> |
Withdraw LP NFT and harvest rewards |
harvest --token-id <ID> |
Claim CAKE rewards without unstaking |
collect-fees --token-id <ID> |
Collect swap fees from unstaked positions |
pending-rewards --token-id <ID> |
View pending CAKE rewards |
positions |
View all LP positions (with optional staked IDs) |
farm-pools |
List active MasterChefV3 farming pools |
Triggers
Activate this skill when users want to farm CAKE rewards from V3 LP positions, harvest farming rewards, collect swap fees, or manage staked NFT positions on PancakeSwap. Use trigger phrases like "stake LP NFT", "farm CAKE", "harvest rewards", or "collect fees".
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Install onchainos CLI + Skills (auto-injected)
```bash
# 1. Install onchainos CLI
onchainos --version 2>/dev/null || curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | sh
# 2. Install onchainos skills (enables AI agent to use onchainos commands)
npx skills add okx/onchainos-skills --yes --global
# 3. Install plugin-store skills (enables plugin discovery and management)
npx skills add MigOKG/plugin-store --skill plugin-store --yes --globalInstall pancakeswap-clmm binary (auto-injected)
if ! command -v pancakeswap-clmm >/dev/null 2>&1; then
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-gnu" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-gnu" ;;
esac
curl -fsSL "https://github.com/MigOKG/plugin-store/releases/download/plugins/pancakeswap-clmm@0.1.0/pancakeswap-clmm-${TARGET}" -o ~/.local/bin/pancakeswap-clmm
chmod +x ~/.local/bin/pancakeswap-clmm
fiReport install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/pancakeswap-clmm"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"pancakeswap-clmm","version":"0.1.0"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"pancakeswap-clmm","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
📋 Phase 3: AI Code Review Report — Score: 76/100
1. Plugin Overview
Summary: This plugin enables PancakeSwap V3 CLMM (Concentrated Liquidity Market Maker) farming operations — staking V3 LP NFTs into MasterChefV3 to earn CAKE rewards, harvesting CAKE, collecting swap fees, and viewing positions across BSC, Ethereum, Base, and Arbitrum. Target Users: DeFi farmers who use PancakeSwap V3 concentrated liquidity positions and want to manage farming/staking via an AI agent interface. 2. Architecture AnalysisComponents:
Skill Structure: Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Wallet Operations
External APIs / URLs
Chains Operated On
Overall Permission SummaryThis plugin reads on-chain data (LP positions, pending rewards, farming pools) via public RPC endpoints and executes DeFi write operations (staking NFTs, harvesting rewards, collecting fees, withdrawing) exclusively through 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes — All write operations (farm, unfarm, harvest, collect-fees) are routed through On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ✅ Fully CompliantAll on-chain write operations use 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Detailed Toxic Flow Detection (TF001-TF006)
No other toxic flows detected. Prompt Injection ScanNo instruction override, identity manipulation, hidden behavior, confirmation bypass, unauthorized operations, or hidden content (base64, invisible characters) detected. Result: ✅ Clean Dangerous Operations CheckThe plugin involves:
Result: Data Exfiltration Risk
Result: Overall Security Rating: 🟡 Medium RiskPrimary concerns:
6. Source Code SecuritySource code is referenced (Rust, Language & Build Config
Dependency AnalysisCannot fully assess without access to
Code Safety Audit
Does SKILL.md accurately describe what the source code does?Cannot fully verify without source code. The SKILL.md is internally consistent and describes a plausible architecture for a PancakeSwap V3 farming plugin. Verdict:
|
| Dimension | Score | Notes |
|---|---|---|
| Completeness (pre-flight, commands, error handling) | 19/25 | 7 commands well-documented with parameters and execution flows. No pre-flight section (defers to onchainos). Missing explicit error handling guidance (what if RPC fails, what if contract reverts). |
| Clarity (descriptions, no ambiguity) | 21/25 | Clear command descriptions with examples. Architecture section explains read vs write split well. The --force flag implication could be clearer. |
| Security Awareness (confirmations, slippage, limits) | 17/25 | Explicit "Ask user to confirm" for all write ops. Data trust boundary declared. However, --force flag misuse, no slippage warnings for fee collection, no mention of sandwich attack risks on harvest. |
| Skill Routing (defers correctly, no overreach) | 12/15 | Clear "Do NOT use for" section. Good relationship description with sibling pancakeswap plugin. Correctly defers swaps and liquidity management. |
| Formatting (markdown, tables, code blocks) | 7/10 | Well-formatted with tables, code blocks, and clear sections. Some inconsistency in command example formatting. |
Strengths
- Clean architecture separation: Read operations via direct RPC, write operations via onchainos wallet contract-call — clean and correct pattern
- Good untrusted data boundary declaration: Includes a clear security notice about treating all CLI output as untrusted external content
- Well-documented execution flows: Each write command has a step-by-step flow including dry-run, verification, confirmation, and post-execution verification steps
- Dry-run support: All write operations support
--dry-runfor preview without broadcasting
Issues Found
-
🔴 Critical:
--forceflag used on first invocation of write operations. The SKILL.md Architecture section states write ops "submits viaonchainos wallet contract-callwith--forceflag". Per theokx-agentic-walletskill rules,--forcemust NEVER be passed on the first invocation — it should only be added after a confirming response is received AND the user explicitly confirms. This bypasses backend safety checks. -
🟡 Important:
plugin-store-dun.vercel.app/installundocumented purpose. This third-party Vercel-hosted URL is declared inapi_callsbut not explained in the SKILL.md. Its purpose, data sent, and data received should be documented and justified. -
🟡 Important: No error handling guidance. SKILL.md lacks guidance for common error scenarios: RPC timeout, contract revert, insufficient gas, NFT not owned, position already staked/unstaked, etc.
-
🟡 Important: No MEV/sandwich attack awareness for harvest. When harvesting CAKE rewards, the transaction could be front-run. No mention of MEV protection via
--mev-protectionflag. -
🔵 Minor:
--output jsonflag ononchainos wallet balance. The onchainos CLI wallet balance command does not appear to have an--output jsonflag based on the source code. The standard output is already JSON. This may cause a CLI error. -
🔵 Minor: Contract address verification note. While hardcoded contract addresses are provided, it would be helpful to include official PancakeSwap documentation links for independent verification.
8. Recommendations
-
🔴 Remove
--forcefrom first invocations: Change the write operation flow to callonchainos wallet contract-callWITHOUT--forcefirst. Only add--forceif a confirming response (exit code 2) is returned AND the user confirms. This is a mandatory fix per the okx-agentic-wallet security protocol. -
🟡 Document or remove
plugin-store-dun.vercel.app: Explain what this endpoint does, what data is sent to it, and why it's needed. If it's for installation telemetry, make that explicit. If it's not needed for runtime operation, consider removing it. -
🟡 Add error handling section: Document common error scenarios and recommended responses (RPC failures, contract reverts, insufficient gas, NFT ownership issues, etc.).
-
🟡 Add MEV protection guidance: For harvest and collect-fees operations on supported chains (BSC, Ethereum, Base), recommend or auto-enable
--mev-protectionflag for high-value operations. -
🔵 Fix
--output jsonflag: Verify the correct onchainos wallet balance flag for machine-readable output, or remove the flag if the default output is already JSON. -
🔵 Add field-level display enumeration: For read commands (positions, pending-rewards, farm-pools), explicitly enumerate which fields should be displayed to users (e.g., "Display: tokenId, token0Symbol, token1Symbol, liquidity, feeTier, pendingCake. Do NOT render raw API response fields directly.").
-
🔵 Add official PancakeSwap contract links: Include links to PancakeSwap's official deployment docs or GitHub for independent contract address verification.
-
🔵 Source code review: A full Rust source code audit at the pinned commit should be conducted before merge, with particular attention to: network requests, data handling, and any hardcoded secrets or unexpected behavior.
9. Reviewer Summary
One-line verdict: Well-structured DeFi farming plugin with correct onchainos API usage for write operations, but critically misuses the --force flag on first write invocations, bypassing backend safety confirmations.
Merge recommendation: 🔍 Needs changes before merge
Items that must be addressed:
- Remove
--forcefrom first invocations of write operations — this is a security protocol violation that bypasses backend confirmation prompts - Clarify the purpose of
plugin-store-dun.vercel.app— undocumented third-party endpoint - Full source code audit of the Rust binary — binary builds must be verified against the pinned commit
Generated by Claude AI via Anthropic API — review the full report before approving.
🔨 Phase 2: Build Verification — ❌ FAILED
Build failed. Check the workflow logs. Source integrity: commit SHA |
1 participant
New Plugin Submission: pancakeswap-clmm v0.1.0
Plugin: PancakeSwap V3 CLMM farming on BSC/Ethereum/Base/Arbitrum
Author: skylavis-sky
Category: defi-protocol
Source