Conversation
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
Phase 4: Summary + Pre-flight for
|
| Command | Description |
|---|---|
markets |
List cToken markets with APRs and exchange rates |
positions [--wallet addr] |
View your supply and borrow positions |
supply --asset TOKEN --amount N |
Supply assets (will fail due to frozen reserves) |
redeem --asset TOKEN --ctoken-amount N |
Redeem cTokens for underlying assets |
borrow --asset TOKEN --amount N |
Preview borrowing (dry-run only) |
repay --asset TOKEN --amount N |
Preview loan repayment (dry-run only) |
claim-comp |
Claim accrued COMP governance rewards |
Triggers
Activate this skill when users want to check their Compound V2 positions, withdraw funds from existing cToken holdings, or claim COMP rewards. Also useful when users mention compound lending, cTokens, or need to exit deprecated V2 positions.
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Install onchainos CLI + Skills (auto-injected)
```bash
# 1. Install onchainos CLI
onchainos --version 2>/dev/null || curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | sh
# 2. Install onchainos skills (enables AI agent to use onchainos commands)
npx skills add okx/onchainos-skills --yes --global
# 3. Install plugin-store skills (enables plugin discovery and management)
npx skills add MigOKG/plugin-store --skill plugin-store --yes --globalInstall compound-v2 binary (auto-injected)
if ! command -v compound-v2 >/dev/null 2>&1; then
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-gnu" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-gnu" ;;
esac
curl -fsSL "https://github.com/MigOKG/plugin-store/releases/download/plugins/compound-v2@0.1.0/compound-v2-${TARGET}" -o ~/.local/bin/compound-v2
chmod +x ~/.local/bin/compound-v2
fiReport install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/compound-v2"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"compound-v2","version":"0.1.0"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"compound-v2","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
📋 Phase 3: AI Code Review Report — Score: 78/100
1. Plugin Overview
Summary: This plugin enables interaction with the Compound V2 protocol on Ethereum mainnet. It provides read-only market data and position queries via direct RPC calls, and executes on-chain write operations (supply, redeem, claim COMP) through the onchainos wallet contract-call CLI. Borrow and repay are restricted to dry-run only. Target Users: DeFi users with existing Compound V2 positions who need to redeem assets or claim COMP rewards. Note: Compound V2 is deprecated and supply/borrow reserves are frozen. 2. Architecture AnalysisComponents:
Skill Structure: Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Wallet Operations
External APIs / URLs
Chains Operated On
Overall Permission SummaryThis plugin reads on-chain data (market rates, balances, positions) via direct 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ✅ Fully CompliantAll on-chain write operations are correctly routed through 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
No matches found for: C01-C09, H01-H04, H06-H09, M01-M06, L01-L02. LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)No toxic flows detected. Rationale:
Prompt Injection ScanNo instruction overrides, no identity manipulation, no hidden behavior, no confirmation bypass, no unauthorized operations, no base64/unicode hidden content detected in SKILL.md or source code. Result: ✅ Clean Dangerous Operations CheckThe plugin involves: token approvals (ERC-20 approve), contract calls (cToken mint, redeem, claimComp), and transaction broadcasting (via onchainos). Confirmation steps:
Result: ✅ Safe Data Exfiltration Risk
Result: ✅ No Risk Overall Security Rating: 🟢 Low Risk6. Source Code Security (if source code is included)Language & Build Config
Dependency Analysis
All dependencies are mainstream, well-maintained Rust crates. No suspicious or unmaintained packages. Cargo.lock is present with pinned versions. Code Safety Audit
Does SKILL.md accurately describe what the source code does?Yes — with minor discrepancies noted below:
Verdict: ✅ Source Safe7. Code ReviewQuality Score: 78/100
Strengths
Issues Found
8. Recommendations
9. Reviewer SummaryOne-line verdict: Well-built Compound V2 plugin with full onchainos compliance, good safety defaults (dry-run, confirm flow), and clean source code. Minor improvements needed around balance pre-checks and amount precision. Merge recommendation: ✅ Ready to merge The plugin is fully onchainos-compliant, has no security vulnerabilities, uses appropriate confirmation mechanisms, and correctly segregates read operations (direct RPC) from write operations (onchainos CLI). The identified issues are quality improvements rather than blockers. Generated by Claude AI via Anthropic API — review the full report before approving. |
1 participant
Summary
compound-v2onchainos wallet contract-callChecklist
🤖 Generated with Claude Code