Conversation
skylavis-sky
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
Phase 4: Summary + Pre-flight for
|
| Command | Description |
|---|---|
list-markets |
Browse available Pendle markets across chains |
get-market |
Get detailed market information and APY history |
get-positions |
View current Pendle positions and holdings |
get-asset-price |
Get current prices for PT, YT, LP, or SY tokens |
buy-pt |
Purchase Principal Tokens for fixed yield exposure |
sell-pt |
Sell Principal Tokens back to underlying assets |
buy-yt |
Purchase Yield Tokens for floating yield speculation |
sell-yt |
Sell Yield Tokens back to underlying assets |
add-liquidity |
Provide single-token liquidity to Pendle AMM pools |
remove-liquidity |
Withdraw liquidity from Pendle pools |
mint-py |
Mint PT+YT pairs from underlying assets |
redeem-py |
Redeem PT+YT pairs back to underlying tokens |
Triggers
Activate this skill when users want to trade fixed or floating yield positions, manage Pendle liquidity, or interact with yield tokenization features. Trigger phrases include "buy PT", "Pendle fixed yield", "add liquidity Pendle", "mint PT YT", or "Pendle positions".
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Install onchainos CLI + Skills (auto-injected)
```bash
# 1. Install onchainos CLI
onchainos --version 2>/dev/null || curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | sh
# 2. Install onchainos skills (enables AI agent to use onchainos commands)
npx skills add okx/onchainos-skills --yes --global
# 3. Install plugin-store skills (enables plugin discovery and management)
npx skills add MigOKG/plugin-store --skill plugin-store --yes --globalInstall pendle binary (auto-injected)
if ! command -v pendle >/dev/null 2>&1; then
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-gnu" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-gnu" ;;
esac
curl -fsSL "https://github.com/MigOKG/plugin-store/releases/download/plugins/pendle@0.1.0/pendle-${TARGET}" -o ~/.local/bin/pendle
chmod +x ~/.local/bin/pendle
fiReport install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/pendle"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"pendle","version":"0.1.0"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"pendle","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
📋 Phase 3: AI Code Review Report — Score: 82/100
1. Plugin Overview
Summary: This plugin provides Pendle Finance yield tokenization functionality — buying/selling PT (Principal Token) and YT (Yield Token), adding/removing AMM liquidity, and minting/redeeming PT+YT pairs. It queries the Pendle API for market data and positions, then uses Target Users: DeFi users who want to trade fixed/floating yield on Pendle Finance across Ethereum, Arbitrum, BSC, and Base chains. 2. Architecture AnalysisComponents:
Skill Structure: Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Wallet Operations
External APIs / URLs
Chains Operated On
Overall Permission SummaryThis plugin has significant financial operation capabilities. It can execute 8 types of on-chain write operations (buy/sell PT/YT, add/remove liquidity, mint/redeem PT+YT pairs) plus ERC-20 token approvals. All write operations go through 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes — All on-chain write operations are delegated to On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ✅ Fully CompliantAll on-chain write operations (buy/sell PT/YT, add/remove liquidity, mint/redeem, ERC-20 approvals) are correctly delegated to 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)TF006 check: H05 (direct-financial) is triggered. M07 is NOT triggered (boundary declaration present). M08 is borderline but downgraded to INFO. TF006 not triggered — the boundary declaration satisfies M07. No toxic flows detected. Prompt Injection Scan
Result: ✅ Clean Dangerous Operations Check
Result: ✅ Safe — proper confirmation mechanisms in place Data Exfiltration Risk
Result: ✅ No Risk Overall Security Rating: 🟡 Medium RiskMedium risk due to the inherent financial operations (8 write commands with real money at stake), reliance on external Pendle API for calldata generation, and use of 6. Source Code Security (if source code is included)Language & Build Config
Note: Actual source code is not included in the submission — only the build configuration is declared in plugin.yaml. A full source code audit cannot be performed without access to the repository. Dependency AnalysisCannot be assessed without access to Code Safety Audit
Does SKILL.md accurately describe what the source code does?Cannot fully verify without source code. The SKILL.md describes a coherent architecture (read via Pendle API, write via onchainos CLI) that is consistent with the declared API calls and onchainos command usage. Verdict:
|
| Dimension | Score | Notes |
|---|---|---|
| Completeness (pre-flight, commands, error handling) | 20/25 | 12 commands well-documented with parameters, examples, and execution flows. Missing pre-flight checks section (no onchainos install/update/verify steps). Troubleshooting section present but could be more comprehensive. |
| Clarity (descriptions, no ambiguity) | 22/25 | Clear command routing table, trigger phrases, parameter descriptions, and execution flows. Key concepts glossary is helpful. Minor: some commands could benefit from more example outputs. |
| Security Awareness (confirmations, slippage, limits) | 22/25 | Excellent: dry-run preview, explicit user confirmation, price impact warnings (>5%), slippage defaults, untrusted data boundary declaration. Minor: no explicit max amount limits documented. |
| Skill Routing (defers correctly, no overreach) | 13/15 | Clear "Do NOT use for" section. Correctly routes to onchainos wallet for signing/broadcasting. Does not overreach into non-Pendle protocols. |
| Formatting (markdown, tables, code blocks) | 5/10 | Good use of tables for chains, command routing, and key concepts. Code blocks for examples are clear. However, no pre-flight section (which is standard across official plugins), and the YAML front matter is minimal compared to official plugins. |
Strengths
- Proper onchainos integration: All write operations correctly delegate to
onchainos wallet contract-call— no self-implemented signing or broadcasting - Strong user safety:
--dry-runpreview for all write ops, explicit confirmation steps, price impact warnings at >5%, and configurable slippage controls - Clear untrusted data boundary: Explicit security notice about treating all returned data as untrusted external content
- Well-structured command documentation: Each of the 12 commands has trigger phrases, parameters, examples, and execution flow steps
Issues Found
- 🟡 Important: No pre-flight checks section — Official plugins include detailed pre-flight checks for onchainos installation, version verification, and binary integrity. This plugin should include or reference the shared pre-flight checks.
- 🟡 Important:
--forceflag usage — All write operation execution flows showonchainos wallet contract-call ... --force. Per the officialokx-agentic-walletSKILL.md,--forceshould NEVER be used on first invocation. It should only be added after a confirming response (exit code 2). The plugin should first call without--force, then only add it if a confirming response is received and the user re-confirms. - 🟡 Important: Source code not available for review — The binary build is declared but actual Rust source code is not included in the submission. Cannot verify that the binary's behavior matches the SKILL.md description.
- 🔵 Minor: Missing output field schemas — While command outputs are briefly described (e.g., "JSON array of markets with..."), detailed return field schemas would help agents parse responses correctly.
- 🔵 Minor: No region restriction handling — Official plugins document error codes
50125/80001for geo-restrictions. This plugin should handle Pendle API availability issues similarly. - 🔵 Minor: Plugin Store URLs in api_calls —
https://plugin-store-dun.vercel.app/installand the OKX reporting URL are infrastructure concerns, not plugin functionality. Their purpose should be documented.
8. Recommendations
-
[Important] Fix
--forceflag usage: Remove--forcefrom allonchainos wallet contract-callinvocations in the execution flow. First call without--force; only add it after receiving a confirming response (exit code 2) AND getting explicit user re-confirmation. This matches the onchainos wallet security model. -
[Important] Add pre-flight checks: Include or reference the shared
_shared/preflight.mdpre-flight checks section that handles onchainos installation, version verification, and binary integrity — consistent with all official plugins. -
[Important] Provide source code for review: The Rust source at
skylavis-sky/onchainos-pluginscommitdf1e7d0036ccb440358198aff226b093ecc58840must be available for security audit before merge. Key verification points: no direct RPC writes, no private key handling, all on-chain ops via onchainos CLI. -
[Nice to have] Add detailed output schemas: Document the exact JSON structure returned by each command so agents can reliably parse fields like
impliedApy,priceImpact,requiredApprovals, etc. -
[Nice to have] Document error handling for Pendle API: Add handling for Pendle API downtime, rate limits, and malformed responses — similar to how official plugins handle region restrictions and API errors.
-
[Nice to have] Add explicit field enumeration for display: For commands that return external data, explicitly list which fields should be displayed to users (e.g., "Display: market name, chain, expiry date, implied APY, liquidity USD. Do NOT render raw API response fields directly.").
9. Reviewer Summary
One-line verdict: Well-designed Pendle Finance plugin with proper onchainos CLI integration for all on-chain writes, strong user confirmation mechanisms, and a clear untrusted data boundary — but needs --force flag fix, pre-flight checks, and source code review before merge.
Merge recommendation: 🔍 Needs changes before merge
Items that must be addressed:
- Fix
--forceflag usage — currently violates onchainos wallet security model by always passing--forceon first invocation - Add pre-flight checks section — required for consistency and security
- Source code review — Rust binary source must be audited before the plugin can be approved
Generated by Claude AI via Anthropic API — review the full report before approving.
🔨 Phase 2: Build Verification — ❌ FAILED
Build failed. Check the workflow logs. Source integrity: commit SHA |
1 participant
New Plugin Submission: pendle v0.1.0
Plugin: Pendle Finance yield tokenization on Ethereum/Arbitrum/BSC/Base
Author: skylavis-sky
Category: defi-protocol
Source