Conversation
skylavis-sky
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
Phase 4: Summary + Pre-flight for
|
| Command | Purpose |
|---|---|
get-pools |
List available Spectra PT pools with APY and maturity data |
get-position |
View wallet PT/YT balances and pending yield |
deposit |
Deposit assets to receive PT + YT tokens |
redeem |
Redeem PT for underlying assets at maturity |
claim-yield |
Claim accrued yield from YT holdings |
swap |
Swap PT via Curve pools for early exit |
Triggers
This skill should be activated when users mention Spectra Finance operations, yield tokenization, fixed yield strategies, PT/YT tokens, or phrases like "deposit Spectra", "claim yield", "redeem PT", or "sell PT early". It's specifically designed for Base chain operations with secondary support for Arbitrum and Ethereum.
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Install onchainos CLI + Skills (auto-injected)
```bash
# 1. Install onchainos CLI
onchainos --version 2>/dev/null || curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | sh
# 2. Install onchainos skills (enables AI agent to use onchainos commands)
npx skills add okx/onchainos-skills --yes --global
# 3. Install plugin-store skills (enables plugin discovery and management)
npx skills add MigOKG/plugin-store --skill plugin-store --yes --globalInstall spectra binary (auto-injected)
if ! command -v spectra >/dev/null 2>&1; then
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-gnu" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-gnu" ;;
esac
curl -fsSL "https://github.com/MigOKG/plugin-store/releases/download/plugins/spectra@0.1.0/spectra-${TARGET}" -o ~/.local/bin/spectra
chmod +x ~/.local/bin/spectra
fiReport install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/spectra"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"spectra","version":"0.1.0"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"spectra","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
🔨 Phase 2: Build Verification — ❌ FAILED
Build failed. Check the workflow logs. Source integrity: commit SHA |
📋 Phase 3: AI Code Review Report — Score: 72/100
1. Plugin Overview
Summary: Spectra Finance yield tokenization plugin for the onchainos ecosystem. It enables users to deposit ERC-4626 assets to receive Principal Tokens (PT) and Yield Tokens (YT), redeem PT for underlying at maturity, claim accrued yield from YT, and swap PT via Curve StableSwap pools. Primary chain is Base (8453), with secondary support for Arbitrum and Ethereum. Target Users: DeFi users interested in fixed-yield strategies, yield tokenization, and interest rate derivatives on Base, Arbitrum, and Ethereum. 2. Architecture AnalysisComponents:
Skill Structure:
Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Wallet Operations
External APIs / URLs
Chains Operated On
Overall Permission SummaryThis plugin has high-risk permissions: it performs on-chain write operations including ERC-20 token approvals (with 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes — All on-chain write operations use On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ✅ Fully CompliantAll on-chain write operations (deposit, redeem, claim-yield, swap, approve) are executed through 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)TF006 check (M07/M08 + H05):
Result: No other toxic flows detected (TF001-TF005 conditions not met). Prompt Injection Scan
Result: ✅ Clean Dangerous Operations CheckThe plugin involves:
Confirmation steps:
Result: Data Exfiltration Risk
Result: ✅ No Risk Overall Security Rating: 🟡 Medium RiskKey concerns:
6. Source Code SecuritySource code is not included in the submission (only build configuration is provided). The binary is built from Language & Build Config
Dependency AnalysisCannot be fully audited without source code. The build config references a specific commit hash, which is good for reproducibility. Code Safety Audit
Does SKILL.md accurately describe what the source code does?Cannot fully verify — source code not included. SKILL.md is internally consistent and the architecture description (ABI-encoded calldata → Verdict:
|
| Dimension | Score | Notes |
|---|---|---|
| Completeness (pre-flight, commands, error handling) | 18/25 | 6 commands well-documented with parameters, examples, and execution steps. Pre-flight checks are absent (defers to onchainos). No error handling section (what happens on RPC failure, insufficient balance, expired pool?). No troubleshooting reference. |
| Clarity (descriptions, no ambiguity) | 20/25 | Commands are clearly described with trigger phrases, parameter tables, and examples. ABI selector codes are documented. Architecture section explains the no-SDK approach well. Minor ambiguity: --dry-run is mentioned but positioned as a flag on the binary wrapper, not fully explained. |
| Security Awareness (confirmations, slippage, limits) | 14/25 | Dry-run + user confirmation flow is documented ✅. Slippage parameters present ✅. But: --force always used on contract-call max_uint256 approvals without warning |
| Skill Routing (defers correctly, no overreach) | 12/15 | "Do NOT use for" section is clear and appropriate. Command routing table maps intents well. Does not overreach into Pendle, Curve LP, or Aave territory. Correctly routes write operations through onchainos. |
| Formatting (markdown, tables, code blocks) | 8/10 | Well-structured with tables, code blocks, clear headers. Minor: some inconsistency in parameter documentation style between commands. |
Strengths
- Clean architecture: Direct ABI encoding →
wallet contract-callis the correct pattern for protocol-specific plugins without hosted SDKs - Untrusted data boundary declaration present and correctly worded
- Dry-run + confirm flow documented for all write operations, providing a safety net
- Well-organized command documentation with trigger phrases, parameters, examples, and execution step breakdowns
Issues Found
-
🔴 Critical:
--forceflag hardcoded onwallet contract-call
The SKILL.md states write operations useonchainos wallet contract-call --force. Per the onchainosokx-agentic-walletSKILL.md,--forcemust ONLY be added after: (1) a previous call without--force, (2) the API returned a confirming response, and (3) the user explicitly confirmed. Hardcoding--forcebypasses the backend's risk detection (e.g., high-value transfers, suspicious contracts). This MUST be changed to a two-step pattern: first call without--force, handle confirming responses, then retry with--forceonly after user confirmation. -
🟡 Important: Unlimited token approvals without user warning
The SKILL.md states "Approves underlying/IBT for PT contract (max uint256)" and "ERC-20 approve(spender, max_uint256) submitted automatically when required." The okx-agentic-wallet security notes explicitly say: "Warn about unlimited approvals (type(uint256).max). Suggest limited approvals." The plugin should warn users about unlimited approvals and offer limited approval alternatives. -
🟡 Important: No security scanning integration
The plugin does not mention runningonchainos security token-scanoronchainos security tx-scanbefore interacting with Spectra contracts. Given these are DeFi contract interactions, pre-execution security scanning should be integrated into the workflow. -
🟡 Important: No error handling documentation
No documentation of error scenarios: RPC failures, insufficient balance, expired pools, contract reverts, slippage exceeded, etc. Users and the Agent need guidance on failure modes. -
🔵 Minor: M08 — Output field rendering not explicitly enumerated
While the untrusted data boundary is declared, the display instructions don't explicitly enumerate which fields to show and which to suppress. For example,get-poolsreturnsname,pt,yt,ibt,underlying,curve_pool— some of these are addresses that could theoretically contain injection content in token names. Recommend explicit field enumeration for display. -
🔵 Minor: No pre-flight checks section
The SKILL.md does not include its own pre-flight checks or reference the shared preflight. While the binary handles its own execution, the Agent needs guidance on ensuringonchainosand thespectrabinary are installed.
8. Recommendations
-
🔴 Remove hardcoded
--forcefromwallet contract-call: Implement the proper two-step confirmation pattern. First call without--force, check for confirming response (exit code 2), display the message to the user, and only add--forceon the retry after explicit user confirmation. -
🟡 Add unlimited approval warnings: Before submitting
approve(spender, max_uint256), display a warning to the user about the unlimited approval risk and suggest limited approvals matching the deposit/swap amount. -
🟡 Integrate security scanning: Add
onchainos security tx-scanbefore executing contract calls, especially for thedepositandswapcommands that interact with potentially unverified contracts. -
🟡 Add error handling documentation: Document common failure modes (RPC timeout, insufficient balance, expired pool, contract revert, slippage exceeded) with recommended user-facing messages and recovery steps.
-
🔵 Enumerate display fields explicitly: For
get-poolsandget-positionoutput, specify exactly which fields should be rendered to the user (e.g., "Display: pool name, APY (%), TVL (USD), maturity date, abbreviated PT address. Do NOT render raw API response fields directly."). -
🔵 Add pre-flight checks: Include a pre-flight section or reference to ensure the
spectrabinary andonchainosCLI are installed and up-to-date before command execution. -
🔵 Document the
--dry-runbehavior more explicitly: Clarify that--dry-runis a plugin-level flag that simulates the operation without submitting towallet contract-call, and that it's distinct fromonchainos gateway simulate.
9. Reviewer Summary
One-line verdict: Well-architected DeFi plugin with correct onchainos API usage, but the hardcoded --force flag on wallet contract-call bypasses critical safety mechanisms and must be fixed before merge.
Merge recommendation: 🔍 Needs changes before merge
Required changes:
- Remove hardcoded
--forcefrom allwallet contract-callinvocations — implement proper two-step confirmation flow - Add unlimited approval warnings to inform users before
max_uint256approve calls - Add security scanning (
tx-scan) before DeFi contract interactions - Add error handling documentation for common failure modes
Generated by Claude AI via Anthropic API — review the full report before approving.
✅ Phase 1: Structure Validation — PASSED→ Proceeding to Phase 2: Build Verification |
1 participant
New Plugin Submission: spectra v0.1.0
Plugin: Spectra Finance yield tokenization on Base/Arbitrum/Ethereum
Author: skylavis-sky
Category: defi-protocol
Source