[new-plugin] term-structure v0.1.0#182
Conversation
skylavis-sky
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
Phase 4: Summary + Pre-flight for
|
| Command | Description |
|---|---|
get-markets |
List active TermMax markets with current APR and liquidity |
get-position |
View current lend (FT) and borrow (GT) positions |
lend |
Lend tokens at fixed rate, receive FT bond tokens |
borrow |
Borrow tokens by posting collateral, receive GT NFT |
repay |
Repay borrow position using GT NFT loanId |
redeem |
Redeem FT tokens after maturity for underlying + interest |
Triggers
Activate when users want fixed-rate lending/borrowing, mention "term structure," "termmax," "fixed rate yield," or need alternatives to variable-rate protocols like Aave for predictable returns.
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Install term-structure binary (auto-injected)
```bash
if ! command -v term-structure >/dev/null 2>&1; then
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-gnu" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-gnu" ;;
esac
curl -fsSL "https://github.com/MigOKG/plugin-store/releases/download/plugins/term-structure@0.1.0/term-structure-${TARGET}" -o ~/.local/bin/term-structure
chmod +x ~/.local/bin/term-structure
fiReport install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/term-structure"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"term-structure","version":"0.1.0"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"term-structure","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
🔨 Phase 2: Build Verification — ❌ FAILED
Build failed. Check the workflow logs. Source integrity: commit SHA |
📋 Phase 3: AI Code Review Report — Score: 48/100
1. Plugin Overview
Summary: This plugin enables fixed-rate lending and borrowing on the TermMax (Term Structure) protocol across Arbitrum, Ethereum, and BNB Chain. It provides market discovery, position viewing, and execution of lend, borrow, repay, and redeem operations through a custom binary that interacts directly with on-chain smart contracts. Target Users: DeFi users seeking fixed-rate yield or borrowing at known rates, particularly those using TermMax V2 markets on Arbitrum, Ethereum, or BNB Chain. 2. Architecture AnalysisComponents:
Skill Structure: Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Wallet Operations
External APIs / URLs
Chains Operated On
Overall Permission SummaryThis plugin performs both read and write on-chain operations across three EVM chains. Write operations include token approvals, lending (swap to FT), borrowing (collateral deposit), repayment, and redemption — all of which involve sending transactions to smart contracts. Critically, the plugin uses its own binary to construct and presumably broadcast transactions directly via public RPC endpoints, completely bypassing the onchainos CLI. It does not use 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?No — This is a critical finding. The plugin self-implements all on-chain write operations through its own binary, bypassing onchainos entirely. On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ❌ Non-CompliantCritical non-compliance: This plugin self-implements ALL on-chain write operations (token approvals, swap execution, transaction broadcasting, contract calls) through its own binary rather than using onchainos CLI. Specifically:
The plugin must be refactored to use onchainos CLI commands for all on-chain write operations. Read operations (get-markets, get-position) querying RPC endpoints are acceptable. 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)TF006 — External data no boundary + financial operations:
Prompt Injection ScanNo instruction override, identity manipulation, hidden behavior, confirmation bypass, unauthorized operations, or hidden content (base64, invisible chars) detected in SKILL.md. Result: ✅ Clean Dangerous Operations CheckThe plugin involves: token approvals, contract calls (lend/borrow/repay/redeem), and transaction broadcasting — all implemented outside onchainos CLI. Write operations do include explicit user confirmation steps ("Ask the user to confirm before executing"), and a Result: Data Exfiltration RiskThe plugin calls Result: Overall Security Rating: 🔴 High RiskPrimary concerns:
6. Source Code Security (if source code is included)Language & Build Config
Dependency AnalysisSource code is NOT included in the submission — only the build config references an external repository. Cannot perform dependency analysis without access to Code Safety Audit
Does SKILL.md accurately describe what the source code does?Cannot determine — source code not included in submission. The SKILL.md describes 6 commands with specific on-chain interactions, but without source code, we cannot verify the binary's actual behavior matches these descriptions. Verdict:
|
| Dimension | Score | Notes |
|---|---|---|
| Completeness (pre-flight, commands, error handling) | 12/25 | No pre-flight checks section. 6 commands documented. Error handling not specified (no error codes, no retry guidance, no edge cases for failed transactions). Missing --from address resolution documentation. |
| Clarity (descriptions, no ambiguity) | 16/25 | Commands are clearly described with examples. Token model well explained. However, the mechanism for transaction signing is completely ambiguous — SKILL.md says "approve RouterV1 to spend" but never explains HOW the approval transaction is signed/broadcast. |
| Security Awareness (confirmations, slippage, limits) | 14/25 | User confirmation required for all writes. --dry-run flag available. Liquidity warning (~$50K limit). Data Trust Boundary declaration present. However: no slippage parameter documented, no price impact warnings, no gas estimation, no security scan integration (no onchainos security tx-scan before writes). |
| Skill Routing (defers correctly, no overreach) | 4/15 | "Do NOT use for" section exists but provides no skill routing to onchainos skills. Does not defer to okx-dex-swap for swap operations, okx-agentic-wallet for wallet management, or okx-security for pre-transaction scanning. Completely self-contained with no onchainos ecosystem integration. |
| Formatting (markdown, tables, code blocks) | 2/10 | Basic markdown structure. Tables used for chains and token model. Code blocks for command examples. However: no parameter tables with types/required flags, no return field schemas, no structured command index table matching the onchainos skill format. |
Strengths
- Clear explanation of the TermMax protocol mechanics (FT/GT token model)
- Explicit user confirmation required before all write operations
--dry-runflag available for testing before execution- Data Trust Boundary declaration included
- Liquidity warning for large orders
Issues Found
- 🔴 Critical: Complete onchainos CLI bypass — All on-chain write operations (approve, lend, borrow, repay, redeem) are self-implemented through the binary. Must be refactored to use
onchainos wallet contract-callfor all write operations andonchainos swap approve/onchainos gateway broadcastwhere applicable. - 🔴 Critical: Unknown signing mechanism — The SKILL.md describes multi-step transactions (approve → execute) but never explains how transactions are signed. The binary appears to handle private key access directly, completely bypassing onchainos wallet's TEE signing infrastructure.
- 🔴 Critical: Source code not auditable — Binary is compiled from an external repository. Without included source code, we cannot verify the binary doesn't contain malicious code, hardcoded addresses, or undeclared network calls.
- 🟡 Important: No pre-flight checks — Missing the standard onchainos preflight section (version check, binary integrity verification, checksum validation).
- 🟡 Important: No onchainos skill routing — Does not reference or defer to any onchainos skills (wallet, security, swap, portfolio). Should integrate with
okx-agentic-walletfor address resolution,okx-securityfor pre-transaction scanning. - 🟡 Important: No slippage controls documented — For swap-like operations (lend uses
swapExactTokenToToken), no slippage tolerance parameter is documented. - 🟡 Important: M08 field passthrough — External data (market addresses, APR rates, token names from on-chain) rendered without explicit field enumeration.
- 🟡 Important: Suspicious installation endpoint —
plugin-store-dun.vercel.appappears to be an unverified personal Vercel deployment. - 🔵 Minor: No error handling documentation (error codes, retry logic, common failure modes).
- 🔵 Minor: No chain name resolution — uses raw chain IDs instead of human-readable names.
- 🔵 Minor: No amount display rules (UI units vs minimal units conventions not specified).
8. Recommendations
-
[CRITICAL] Refactor all write operations to use onchainos CLI: Replace self-implemented transaction signing/broadcasting with
onchainos wallet contract-callfor all contract interactions (lend, borrow, repay, redeem) andonchainos swap approveoronchainos wallet contract-callfor token approvals. The binary should only construct calldata and return it for onchainos to sign and broadcast. -
[CRITICAL] Include source code in submission or provide verifiable build: Either include the full Rust source code in the submission, or provide reproducible build instructions with deterministic compilation so reviewers can verify the binary matches the source at the declared commit.
-
[CRITICAL] Integrate with onchainos wallet for signing: Use
onchainos wallet contract-call --to <contract> --chain <chainId> --input-data <calldata>for all on-chain write operations. This ensures TEE-based signing and eliminates direct private key handling by the binary. -
[HIGH] Add pre-flight checks section: Include the standard onchainos preflight checks (binary version, checksum verification, integrity validation).
-
[HIGH] Add skill routing: Reference and defer to appropriate onchainos skills —
okx-agentic-walletfor wallet/address resolution,okx-securityfor pre-transaction security scanning (onchainos security tx-scan),okx-wallet-portfoliofor balance checks before transactions. -
[HIGH] Add slippage control: Document and implement slippage tolerance parameters for the lend command's swap operation and any other price-sensitive operations.
-
[HIGH] Verify or replace the plugin-store-dun.vercel.app endpoint: This appears to be an unverified personal deployment. Either verify its ownership and security, or remove it in favor of an official distribution channel.
-
[MEDIUM] Add explicit field enumeration for display: Specify which fields from CLI output are safe to render (e.g., "Display: market address (abbreviated), APR rate, maturity date, underlying symbol, FT liquidity. Do NOT render raw contract response fields directly.").
-
[MEDIUM] Add error handling documentation: Include common error codes, retry logic, and failure mode handling.
-
[LOW] Adopt onchainos chain name conventions: Use human-readable chain names (
arbitrum,ethereum,bsc) with CLI resolution instead of raw chain IDs.
9. Reviewer Summary
One-line verdict: Plugin self-implements all on-chain write operations (approvals, signing, broadcasting) through its own unauditable binary, completely bypassing the onchainos CLI — this is a critical compliance violation that must be resolved before any merge consideration.
Merge recommendation: 🔍 Needs changes before merge
Required changes before merge:
- Refactor ALL write operations to use onchainos CLI (
wallet contract-call,swap approve,gateway broadcast) - Include auditable source code in the submission or provide reproducible build
- Remove direct transaction signing from the binary — use onchainos wallet's TEE infrastructure
- Add pre-flight checks and onchainos skill routing
- Verify or replace the
plugin-store-dun.vercel.appendpoint - Add slippage controls for price-sensitive operations
- Address M08 field passthrough with explicit field enumeration
Generated by Claude AI via Anthropic API — review the full report before approving.
✅ Phase 1: Structure Validation — PASSED→ Proceeding to Phase 2: Build Verification |
1 participant
New Plugin Submission: term-structure v0.1.0
Plugin: TermMax fixed-rate lending and borrowing on Arbitrum/Ethereum/BNB
Author: skylavis-sky
Category: defi-protocol
Source