Conversation
LI.FI/Jumper cross-chain bridge and swap aggregator supporting 79+ EVM chains. Routes via best available bridges (Across, Stargate, Hop) and DEXes. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
Phase 4: Summary + Pre-flight for
|
| Command | Description |
|---|---|
get-chains |
List all supported EVM chains |
get-tokens |
Show available tokens on specific chains |
get-quote |
Get best-route quote for cross-chain transfers |
swap |
Execute cross-chain bridge/swap transactions |
get-status |
Check transfer status by transaction hash |
get-tools |
List available bridges and DEXes |
Triggers
Activate this skill when users want to bridge tokens between different chains, swap tokens across networks, check cross-chain transfer status, or discover supported chains and tokens. The skill should also be triggered for queries about LI.FI protocol capabilities and multi-chain DeFi operations.
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Install onchainos CLI + Skills (auto-injected)
```bash
# 1. Install onchainos CLI
onchainos --version 2>/dev/null || curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | sh
# 2. Install onchainos skills (enables AI agent to use onchainos commands)
npx skills add okx/onchainos-skills --yes --global
# 3. Install plugin-store skills (enables plugin discovery and management)
npx skills add MigOKG/plugin-store --skill plugin-store --yes --globalInstall lifi binary (auto-injected)
if ! command -v lifi >/dev/null 2>&1; then
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-gnu" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-gnu" ;;
esac
curl -fsSL "https://github.com/MigOKG/plugin-store/releases/download/plugins/lifi@0.1.0/lifi-${TARGET}" -o ~/.local/bin/lifi
chmod +x ~/.local/bin/lifi
fiReport install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/lifi"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"lifi","version":"0.1.0"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"lifi","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
📋 Phase 3: AI Code Review Report — Score: 82/100
1. Plugin Overview
Summary: This plugin integrates the LI.FI/Jumper cross-chain bridge and DEX aggregator into the onchainos ecosystem. It provides read-only commands (chain listing, token listing, quote, status, tools) via the LI.FI REST API, and a write command ( Target Users: DeFi users who want to bridge tokens across 79+ EVM chains or execute cross-chain swaps using LI.FI's aggregated routing. 2. Architecture AnalysisComponents:
Skill Structure: Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Wallet Operations
External APIs / URLs
Chains Operated OnEthereum (1), Base (8453), Arbitrum (42161), Polygon (137), Optimism (10), BSC (56), Avalanche (43114), zkSync Era (324), Linea (59144), and 79+ EVM chains supported by LI.FI. Overall Permission SummaryThis plugin queries the LI.FI REST API for bridge/swap quotes and token data (read operations), checks ERC-20 allowances via direct RPC 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ✅ Fully CompliantAll on-chain write operations (ERC-20 approve, bridge/swap transaction submission) are performed exclusively through 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)
Prompt Injection ScanNo instruction overrides, identity manipulation, hidden behavior, confirmation bypass, unauthorized operations, or hidden content (base64, invisible chars) detected in SKILL.md or source code. Result: ✅ Clean Dangerous Operations CheckThe plugin involves: contract calls (ERC-20 approve + bridge/swap), financial transactions (cross-chain bridging).
Result: ✅ Safe Data Exfiltration RiskThe plugin sends wallet addresses and transaction data to the LI.FI API as part of normal operation (required for quote generation). This is inherent to the plugin's bridge/swap functionality. No sensitive credentials (private keys, session tokens, API keys) are sent to external services. Result: Overall Security Rating: 🟡 Medium RiskThe medium risk rating is due to: (1) cross-chain bridge operations carry inherent smart contract risk, (2) wallet address is shared with third-party LI.FI API, (3) calldata from an external API is passed to onchainos for execution. However, all write operations are properly gated and use onchainos. 6. Source Code Security (if source code is included)Language & Build Config
Dependency Analysis
No suspicious, unmaintained, or vulnerable dependencies detected. All are standard Rust ecosystem crates. Code Safety Audit
Does SKILL.md accurately describe what the source code does?Yes — SKILL.md accurately describes:
One minor discrepancy: SKILL.md mentions Verdict: ✅ Source Safe7. Code ReviewQuality Score: 82/100
Strengths
Issues Found
8. Recommendations
9. Reviewer SummaryOne-line verdict: Well-implemented cross-chain bridge plugin with excellent onchainos compliance, proper security gates, and clean code — needs minor improvements to approval handling and address resolution. Merge recommendation: The plugin is functionally correct and security-compliant. The noted caveats are:
None of these are blocking issues — the plugin correctly delegates all on-chain writes to onchainos, validates the target contract address, requires explicit user confirmation, and uses exact-amount approvals. Generated by Claude AI via Anthropic API — review the full report before approving. |
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
- swap command now shows preview by default; --confirm required to broadcast - removed hardcoded force=true in wallet_contract_call (was bypassing user confirmation) - erc20_approve now takes force param (maps to caller's --confirm) - SKILL.md: document two-step flow, add untrusted data boundary (M07) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
✅ Phase 1: Structure Validation — PASSED→ Proceeding to Phase 2: Build Verification |
… api_calls - erc20_approve now uses exact fromAmount instead of u128::MAX (critical security fix) - Added publicnode.com RPC endpoints to plugin.yaml api_calls for transparency Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
- validate transactionRequest.to against LiFiDiamond address (security check) - erc20_approve no longer passes --force; onchainos handles approve risk independently - fix Polygon RPC endpoint (polygon-mainnet-rpc, not polygon-bsc-rpc) - SKILL.md: document to validation and pre-execution security scan tip Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
- fix: pass force=false on first swap attempt; surface onchainos risk warnings then retry with force=true (user already confirmed via --confirm) - fix: replace hardcoded 15s approval sleep with chain-specific wait (3s Base/Arb/Op, 6s Polygon/BSC/Avax, 20s Ethereum) - fix: u64->u128 for native value parsing to avoid overflow on large txs
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
Per Phase 3 review: auto-retry with --force is a security issue. - Remove the try-without-force, retry-with-force pattern entirely - Add explicit --force flag to swap command in main.rs and execute() - Pass force directly to onchainos — no silent escalation - If onchainos returns a risk warning without --force, call fails with the warning visible; user re-runs with --force only after reviewing - Document the three-step flow in SKILL.md
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
1 participant
Summary
LI.FI/Jumper cross-chain bridge and swap aggregator.
onchainos wallet contract-callto LiFiDiamond contractCommands
get-chainsget-tokensget-quoteget-statusget-toolsswap--confirm)Checklist
--confirmrequired to broadcast🤖 Generated with Claude Code