[new-plugin] vertex-edge v0.1.0#183
Conversation
skylavis-sky
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
Phase 4: Summary + Pre-flight for
|
| Command | Description |
|---|---|
get-markets |
List all Vertex Edge markets with prices and open interest |
get-positions |
View perp positions and spot balances for a wallet |
get-orderbook |
Query bid/ask depth for a specific market |
get-prices |
Get current mark and index prices for perp markets |
deposit |
Deposit USDC collateral (requires on-chain transactions) |
Triggers
Activate this skill when users mention Vertex Edge trading activities, checking perpetual positions, querying market data, orderbook analysis, or depositing collateral. Trigger phrases include "vertex edge markets," "vertex perp positions," "vertex orderbook," "vertex deposit," and "vertex funding rate."
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Install vertex-edge binary (auto-injected)
```bash
if ! command -v vertex-edge >/dev/null 2>&1; then
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-gnu" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-gnu" ;;
esac
curl -fsSL "https://github.com/MigOKG/plugin-store/releases/download/plugins/vertex-edge@0.1.0/vertex-edge-${TARGET}" -o ~/.local/bin/vertex-edge
chmod +x ~/.local/bin/vertex-edge
fiReport install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/vertex-edge"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"vertex-edge","version":"0.1.0"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"vertex-edge","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
🔨 Phase 2: Build Verification — ❌ FAILED
Build failed. Check the workflow logs. Source integrity: commit SHA |
📋 Phase 3: AI Code Review Report — Score: 62/100
1. Plugin Overview
Summary: This plugin provides read and write access to Vertex Edge, a cross-chain perpetual DEX primarily on Arbitrum. It enables querying markets, positions, orderbook depth, and prices, as well as depositing USDC collateral (which triggers on-chain approve + deposit transactions). Order placement and withdrawals are explicitly out of scope for v0.1. Target Users: DeFi traders using Vertex Edge perpetual DEX who want to monitor positions, check orderbook depth, and deposit collateral through an AI agent interface. 2. Architecture AnalysisComponents:
Skill Structure:
Data Flow:
The SKILL.md states deposit "triggers TWO on-chain transactions: ERC-20 approve + depositCollateral" but does NOT specify whether it uses Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Critical observation: The SKILL.md makes no reference to any Wallet Operations
External APIs / URLs
Chains Operated On
Overall Permission SummaryThis plugin reads market data, positions, orderbook, and prices from Vertex Protocol APIs (low risk). It also performs on-chain write operations (ERC-20 approve + collateral deposit) on Arbitrum. The SKILL.md does not specify how these on-chain write operations are executed — it does not reference 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Unknown / Likely No — The SKILL.md does not reference any onchainos commands for the deposit operation. The binary appears to handle the full deposit flow internally. On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ❌ Non-CompliantCritical finding: The What needs to change:
5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)TF006 — External data no boundary + financial operations:
Prompt Injection Scan
Result: ✅ Clean Dangerous Operations Check
Result: Data Exfiltration Risk
Result: ✅ No Risk Overall Security Rating: 🟡 Medium RiskThe plugin has legitimate functionality but: (1) does not use onchainos for on-chain write operations (critical compliance issue), (2) lacks field-level isolation for external data rendering, and (3) the binary's deposit mechanism is opaque regarding key management and signing. 6. Source Code Security (if source code is included)Language & Build Config
Dependency AnalysisSource code is not included in the submission — only a reference to an external repo and commit. Cannot perform dependency analysis without access to Code Safety Audit
Does SKILL.md accurately describe what the source code does?Cannot determine — source code is not included in the submission. The SKILL.md describes 5 commands and their expected behavior, but without source code we cannot verify:
Verdict:
|
| Dimension | Score | Notes |
|---|---|---|
| Completeness (pre-flight, commands, error handling) | 14/25 | 5 commands well-described; missing pre-flight checks section; no error handling guidance; no troubleshooting section |
| Clarity (descriptions, no ambiguity) | 17/25 | Commands are clearly described with examples; key concepts section is helpful; however, the deposit flow is ambiguous regarding how signing works |
| Security Awareness (confirmations, slippage, limits) | 15/25 | Data trust boundary is present; deposit asks for user confirmation; --dry-run option is good; but no slippage controls, no amount limits, no onchainos integration for signing |
| Skill Routing (defers correctly, no overreach) | 8/15 | "Do NOT use for" section is good (explicitly excludes order placement, withdrawals, swaps); but doesn't reference onchainos skills for signing/broadcasting |
| Formatting (markdown, tables, code blocks) | 8/10 | Well-formatted with code blocks, tables, and clear sections; minor: no parameter tables with types/defaults |
Strengths
- Clear "Do NOT use for" section that explicitly scopes the plugin's limitations (no order placement, no withdrawals, no spot swaps)
- Data Trust Boundary declaration present with clear language about treating all data as untrusted
--dry-runflag for the deposit command allows safe simulation before executing- Well-structured command examples with realistic usage patterns
Issues Found
- 🔴 Critical: On-chain operations bypass onchainos CLI — The
depositcommand performs ERC-20 approve and depositCollateral transactions without using onchainos for signing/broadcasting. This is the primary compliance failure and must be fixed before merge. - 🔴 Critical: Source code not included in submission — Cannot verify binary safety, key handling, or actual network behavior. Source audit at referenced commit is mandatory.
- 🟡 Important: No pre-flight checks section — Unlike official onchainos plugins, this SKILL.md lacks the standard pre-flight section for ensuring onchainos is installed and up-to-date.
- 🟡 Important: Missing field-level isolation for displayed data — Commands like
get-markets,get-positions,get-orderbookdon't specify which fields should be rendered, allowing raw API responses to flow into agent context (M08). - 🟡 Important: No explicit parameter documentation — Missing detailed parameter tables with types, required/optional flags, default values, and constraints.
- 🟡 Important:
--from/--addressparameter security — Thedepositcommand accepts--fromto specify a wallet address but doesn't explain how this interacts with signing. If the binary handles signing internally, this is a major security concern. - 🔵 Minor: Chain support mismatch — SKILL.md lists 5 chains but deposit only works on Arbitrum. Consider more prominent labeling of chain-specific limitations per command.
- 🔵 Minor: Missing post-execution suggestions — No guidance on what to do after each command (e.g., "after deposit, check positions to verify").
8. Recommendations
-
🔴 MANDATORY — Refactor deposit to use onchainos CLI: The
depositcommand must delegate signing and broadcasting toonchainos wallet contract-callfor Agentic Wallet users or output unsigned calldata for manual signing viaonchainos gateway broadcast. The binary should only generate the transaction calldata (approve data + deposit data) and let onchainos handle the on-chain write path. -
🔴 MANDATORY — Include source code or provide verified build: Either include the Rust source in the submission or provide a reproducible build process. The reviewer must be able to verify the binary matches the claimed source at commit
df1e7d0036ccb440358198aff226b093ecc58840. -
🟡 Add pre-flight checks section: Include the standard onchainos pre-flight checks (version verification, binary integrity, skill version drift) as seen in official plugins.
-
🟡 Add field-level isolation for data display: For each command that returns external data, enumerate the specific fields that should be rendered (e.g., for
get-markets: showsymbol,product_id,oracle_price,open_interestonly). Wrap external data in boundary markers. -
🟡 Add detailed parameter tables: For each command, provide a table with parameter name, type, required/optional, default value, and validation constraints.
-
🟡 Document the signing flow explicitly: Clearly state in SKILL.md that the deposit flow uses
onchainos wallet contract-callfor the approve and deposit steps, with specific command examples showing the full integration. -
🔵 Add post-execution suggestions: After each command, suggest logical next steps (e.g., after deposit → check positions; after get-markets → get-orderbook for a specific market).
-
🔵 Add error handling guidance: Include common error codes and troubleshooting steps (e.g., insufficient USDC balance, approval already exists, Vertex API timeout).
9. Reviewer Summary
One-line verdict: Plugin provides useful Vertex Edge DEX integration for read operations but critically fails onchainos compliance by self-implementing on-chain write operations (deposit), and lacks source code for verification.
Merge recommendation: 🔍 Needs changes before merge
The following items MUST be addressed:
- Refactor
depositcommand to use onchainos CLI (onchainos wallet contract-calloronchainos gateway broadcast) for all on-chain write operations (ERC-20 approve + depositCollateral) - Include source code in the submission or provide a reproducible build process that allows full source audit
- Add pre-flight checks section to SKILL.md
- Add field-level display isolation for external data returned by read commands
Generated by Claude AI via Anthropic API — review the full report before approving.
✅ Phase 1: Structure Validation — PASSED→ Proceeding to Phase 2: Build Verification |
1 participant
New Plugin Submission: vertex-edge v0.1.0
Plugin: Vertex Edge perpetual DEX on Arbitrum — markets, positions, orderbook
Author: skylavis-sky
Category: defi-protocol
Source