Conversation
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
📋 Phase 3: AI Code Review Report — Score: 82/100
1. Plugin Overview
Summary: This plugin enables interaction with GMX V1, a decentralized perpetuals and spot trading protocol on Arbitrum and Avalanche. It supports token swaps, buying/selling GLP liquidity tokens, opening/closing leveraged perpetual positions, and ERC-20 token approvals. Read operations query GMX's REST API; all write operations are delegated to Target Users: DeFi traders who want to trade perpetuals, provide GLP liquidity, or swap tokens on GMX V1 via an AI agent interface. 2. Architecture AnalysisComponents:
Skill Structure: Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Wallet Operations
External APIs / URLs
Chains Operated On
Overall Permission SummaryThis plugin can execute high-value on-chain write operations including token swaps, leveraged perpetual position management (open/close), GLP liquidity provision (buy/sell), and unlimited ERC-20 token approvals — all via 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ✅ Fully CompliantAll on-chain write operations are properly delegated to 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)
No toxic flows detected. Prompt Injection Scan
Result: ✅ Clean Dangerous Operations Check
Result: ✅ Safe — adequate confirmation mechanisms in place Data Exfiltration Risk
Result: ✅ No Risk Overall Security Rating: 🟡 Medium RiskMedium risk due to the inherent nature of DeFi operations (leveraged trading, token approvals, liquidity management) rather than any security design flaws. The plugin implements proper confirmation gates and uses onchainos correctly for all on-chain operations. 6. Source Code Security (if source code is included)Language & Build Config
Dependency Analysis
All dependencies are well-known, actively maintained Rust crates with no known vulnerabilities. No suspicious or unmaintained packages. Code Safety Audit
Does SKILL.md accurately describe what the source code does?Yes — SKILL.md accurately describes all 8 commands, their parameters, and behavior. The source code confirms:
Verdict: ✅ Source Safe7. Code ReviewQuality Score: 82/100
Strengths
Issues Found
8. Recommendations
9. Reviewer SummaryOne-line verdict: Well-architected GMX V1 plugin that correctly delegates all on-chain operations to onchainos, with proper confirmation gates, but needs slippage protection defaults and approval risk warnings. Merge recommendation: Items to address before or shortly after merge:
Generated by Claude AI via Anthropic API — review the full report before approving. |
Phase 4: Summary + Pre-flight for
|
| Command | Purpose |
|---|---|
get-prices |
Fetch current oracle prices for all GMX V1 tokens |
get-positions |
View open perpetual positions for a wallet |
swap |
Swap ERC-20 tokens via GMX V1 Router |
buy-glp |
Mint GLP tokens by depositing ERC-20 tokens |
sell-glp |
Redeem GLP tokens for ERC-20 tokens |
open-position |
Open leveraged long/short perpetual positions |
close-position |
Close perpetual positions (partial or full) |
approve-token |
Approve ERC-20 tokens for GMX contracts |
Triggers
Activate this skill when users want to trade perpetuals with leverage, swap tokens on GMX V1, manage GLP liquidity positions, or check current token prices and open positions on the GMX V1 protocol.
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Install onchainos CLI + Skills (auto-injected)
```bash
# 1. Install onchainos CLI
onchainos --version 2>/dev/null || curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | sh
# 2. Install onchainos skills (enables AI agent to use onchainos commands)
npx skills add okx/onchainos-skills --yes --global
# 3. Install plugin-store skills (enables plugin discovery and management)
npx skills add MigOKG/plugin-store --skill plugin-store --yes --globalInstall gmx-v1 binary (auto-injected)
if ! command -v gmx-v1 >/dev/null 2>&1; then
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-gnu" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-gnu" ;;
esac
curl -fsSL "https://github.com/MigOKG/plugin-store/releases/download/plugins/gmx-v1@0.1.0/gmx-v1-${TARGET}" -o ~/.local/bin/gmx-v1
chmod +x ~/.local/bin/gmx-v1
fiReport install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/gmx-v1"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"gmx-v1","version":"0.1.0"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"gmx-v1","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
1 participant
Summary
gmx-v1onchainos wallet contract-callChecklist
🤖 Generated with Claude Code