Conversation
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
Phase 4: Summary + Pre-flight for
|
| Command | Description |
|---|---|
pools |
List top Balancer V2 pools by liquidity |
pool-info |
Get detailed pool information (tokens, balances, weights) |
quote |
Get swap quotes via on-chain BalancerQueries contract |
positions |
View LP positions and BPT holdings for connected wallet |
swap |
Execute token swaps through Vault.swap() |
join |
Add liquidity to pools via Vault.joinPool() |
exit |
Remove liquidity from pools via Vault.exitPool() |
Triggers
Activate this skill when users want to interact with Balancer V2 DEX, including swapping tokens, checking pool information, managing liquidity positions, or getting swap quotes on Arbitrum or Ethereum networks. The skill should also trigger when users mention Balancer-specific terms like BPT, weighted pools, or the Vault contract.
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Install onchainos CLI + Skills (auto-injected)
```bash
# 1. Install onchainos CLI
onchainos --version 2>/dev/null || curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | sh
# 2. Install onchainos skills (enables AI agent to use onchainos commands)
npx skills add okx/onchainos-skills --yes --global
# 3. Install plugin-store skills (enables plugin discovery and management)
npx skills add MigOKG/plugin-store --skill plugin-store --yes --globalInstall balancer-v2 binary (auto-injected)
if ! command -v balancer-v2 >/dev/null 2>&1; then
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-gnu" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-gnu" ;;
esac
curl -fsSL "https://github.com/MigOKG/plugin-store/releases/download/plugins/balancer-v2@0.1.0/balancer-v2-${TARGET}" -o ~/.local/bin/balancer-v2
chmod +x ~/.local/bin/balancer-v2
fiReport install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/balancer-v2"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"balancer-v2","version":"0.1.0"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"balancer-v2","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
📋 Phase 3: AI Code Review Report — Score: 72/100
1. Plugin Overview
Summary: This plugin provides a CLI interface for interacting with Balancer V2 DEX on Arbitrum and Ethereum. It supports pool discovery via the Balancer GraphQL API, on-chain read queries via direct RPC Target Users: DeFi users who want to interact with Balancer V2 weighted and stable pools — querying pool data, getting swap quotes, executing swaps, and managing liquidity positions. 2. Architecture AnalysisComponents:
Skill Structure:
Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Wallet Operations
External APIs / URLs
Chains Operated On
Overall Permission SummaryThis plugin reads pool data from the Balancer GraphQL API and public RPC nodes (no auth needed). For write operations (swap, liquidity add/remove, token approvals), it constructs ABI-encoded calldata locally and delegates all signing and broadcasting to 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes — all on-chain write operations (swap, join, exit, approve) are routed through On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ✅ Fully CompliantAll on-chain write operations correctly use 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)
No other toxic flows detected. Prompt Injection ScanNo instruction overrides, identity manipulation, hidden behavior, confirmation bypasses, unauthorized operations, or hidden content (base64, invisible chars) detected in SKILL.md or source code. Result: ✅ Clean Dangerous Operations Check
Result: Data Exfiltration RiskNo sensitive data (private keys, tokens, credentials) is sent to external services. RPC calls only send contract call parameters. GraphQL queries are read-only pool discovery. Result: ✅ No Risk Overall Security Rating: 🟡 Medium RiskThe plugin correctly delegates all write operations to onchainos. Main concerns:
6. Source Code Security (if source code is included)Language & Build Config
Dependency AnalysisKey dependencies are all well-known, maintained crates from the Rust ecosystem:
No suspicious, unmaintained, or vulnerable dependencies detected. Code Safety Audit
Does SKILL.md accurately describe what the source code does?Yes — the SKILL.md accurately describes all 7 commands and their behavior matches the source code. The flow descriptions (preview → confirm → broadcast) match the implementation. The security notice about untrusted data is present in both SKILL.md and is consistent with the code's behavior. Minor discrepancy: SKILL.md mentions Verdict: ✅ Source Safe7. Code ReviewQuality Score: 72/100
Strengths
Issues Found
8. Recommendations
9. Reviewer SummaryOne-line verdict: Well-architected Balancer V2 plugin that correctly delegates all write operations to onchainos, but always bypasses onchainos's confirmation layer with Merge recommendation: 🔍 Needs changes before merge Items that must be addressed:
Generated by Claude AI via Anthropic API — review the full report before approving. |
1 participant
Summary
balancer-v2onchainos wallet contract-callChecklist
🤖 Generated with Claude Code