Conversation
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
📋 Phase 3: AI Code Review Report — Score: 82/100
1. Plugin Overview
Summary: This plugin enables interaction with the Frax Ether liquid staking protocol on Ethereum mainnet. It allows users to stake ETH to receive frxETH, stake frxETH to receive yield-bearing sfrxETH (ERC-4626 vault), unstake sfrxETH back to frxETH, and query current rates/positions. Write operations are routed through Target Users: DeFi users who want to participate in Frax Ether liquid staking, earning yield on staked ETH through the sfrxETH vault. 2. Architecture AnalysisComponents:
Skill Structure: Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Wallet Operations
External APIs / URLs
Chains Operated On
Overall Permission SummaryThis plugin can execute high-value on-chain write operations on Ethereum mainnet: staking ETH (sending native ETH), approving ERC-20 tokens, depositing into ERC-4626 vaults, and redeeming shares. All write operations are properly routed through 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes — All on-chain write operations (stake, approve, deposit, redeem) go through On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ✅ Fully CompliantAll on-chain write operations (stake ETH, approve frxETH, deposit frxETH, redeem sfrxETH) are routed through 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)TF006 check: M07/M08 (borderline) + H05 (financial operations) — The untrusted data boundary declaration exists in the Security Notices section of SKILL.md, though field-level isolation is not explicitly enumerated. Given the generic declaration is present and the binary itself constructs specific JSON output fields, this is a borderline case. Not triggered at HIGH level due to the existing declaration, but noted as an improvement area. No toxic flows detected. Prompt Injection ScanNo instruction overrides, identity manipulation, hidden behavior, confirmation bypasses, unauthorized operations, or hidden content (base64, invisible chars) detected in SKILL.md or source code. Result: ✅ Clean Dangerous Operations CheckThe plugin involves:
All write operations have explicit user confirmation steps:
Result: ✅ Safe Data Exfiltration Risk
Result: ✅ No Risk Overall Security Rating: 🟡 Medium RiskThe plugin is well-designed with proper onchainos integration and user confirmation mechanisms. Medium risk due to the inherent financial nature of staking operations and the borderline M07/M08 findings regarding field-level data isolation. 6. Source Code Security (if source code is included)Language & Build Config
Dependency Analysis
All dependencies are well-known, actively maintained Rust crates with no known vulnerabilities. Code Safety Audit
Does SKILL.md accurately describe what the source code does?Yes — The SKILL.md accurately describes all 5 commands (stake, stake-frx, unstake, rates, positions), their parameters, execution flow, and the two-step architecture (read via direct RPC, write via onchainos). Contract addresses match between SKILL.md and Verdict: ✅ Source Safe7. Code ReviewQuality Score: 82/100
Strengths
Issues Found
8. Recommendations
9. Reviewer SummaryOne-line verdict: Well-implemented Frax Ether staking plugin with clean onchainos integration and proper confirmation safeguards; needs minor improvements to transaction sequencing and balance validation. Merge recommendation: The following should be addressed before or shortly after merge:
Generated by Claude AI via Anthropic API — review the full report before approving. |
Phase 4: Summary + Pre-flight for
|
| Command | Description |
|---|---|
stake --amount <eth> |
Stake ETH → frxETH via frxETHMinter |
stake-frx --amount <frxeth> |
Stake frxETH → sfrxETH (ERC-4626 deposit) |
unstake --amount <sfrxeth> |
Redeem sfrxETH → frxETH (ERC-4626 redeem) |
rates |
Get current sfrxETH APR and exchange rate |
positions [--address <addr>] |
Query frxETH + sfrxETH balances |
Triggers
Activate this skill when users want to stake ETH through Frax protocol, earn yield on frxETH holdings, check sfrxETH rates and APR, or manage their liquid staking positions. Trigger phrases include "stake ETH frax", "frxETH yield", "sfrxETH position", and "frax liquid staking".
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Install onchainos CLI + Skills (auto-injected)
```bash
# 1. Install onchainos CLI
onchainos --version 2>/dev/null || curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | sh
# 2. Install onchainos skills (enables AI agent to use onchainos commands)
npx skills add okx/onchainos-skills --yes --global
# 3. Install plugin-store skills (enables plugin discovery and management)
npx skills add MigOKG/plugin-store --skill plugin-store --yes --globalInstall frax-ether binary (auto-injected)
if ! command -v frax-ether >/dev/null 2>&1; then
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-gnu" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-gnu" ;;
esac
curl -fsSL "https://github.com/MigOKG/plugin-store/releases/download/plugins/frax-ether@0.1.0/frax-ether-${TARGET}" -o ~/.local/bin/frax-ether
chmod +x ~/.local/bin/frax-ether
fiReport install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/frax-ether"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"frax-ether","version":"0.1.0"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"frax-ether","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
1 participant
Summary
frax-etheronchainos wallet contract-callChecklist
🤖 Generated with Claude Code