Conversation
…ng (v0.4.9) Add a `quickstart` subcommand that acts as a single-call status probe: checks CLOB region access, reads EOA POL + USDC.e balances, reads proxy USDC.e balance (when `setup-proxy` has been run), and queries open positions on the maker wallet. Emits a single JSON with a `status` field plus a ready-to-run `next_command` for the recommended action. State machine (7 states, defaults to guiding users toward the gasless proxy flow): - restricted — CLOB blocked this IP (US/OFAC) → change region - active — has open positions → get-positions - proxy_ready — proxy funded ≥ $5 → list-markets → buy - needs_deposit — proxy set up but under-funded; EOA ≥ $5 → deposit - needs_setup — EOA ≥ $5, proxy not set up → setup-proxy (default) - low_balance — EOA has some USDC.e but < $5 → top up - no_funds — EOA empty → send USDC.e to EOA Minimum balance threshold is $5 for both EOA and proxy wallets. The suggested deposit amount is 90 % of EOA USDC.e, floored to cents, and clamped to >= $5. Non-blocking RPC handling: balance/position calls use unwrap_or to tolerate transient failures — the command still emits guidance based on whatever state it could resolve, instead of exiting with an error. This matches the hyperliquid quickstart pattern. Docs: - SUMMARY.md: convert `**X**` headers to `## X`, rewrite Quick Start as a status-dispatched checklist keyed off `quickstart` output - SKILL.md: add `### quickstart` section with parameters, output fields, status table, and agent flow; add quickstart row to the Commands table; bump inline 0.4.8 → 0.4.9 references No new external API domains — reuses existing check_clob_access, get_pol_balance, get_usdc_balance, and get_positions helpers that are already covered by plugin.yaml api_calls. Version bump: 0.4.8 → 0.4.9 (PATCH, per owner decision). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GeoGu360
had a problem deploying
to
summary-generation
GitHub Actions
Error
Contributor
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
…sites Rework the POL-for-gas bullet to lead with the recommended (POLY_PROXY) path instead of EOA. This aligns SUMMARY.md with the product direction already reflected elsewhere: - `quickstart` defaults to guiding new users toward `setup-proxy` - SKILL.md's mode comparison table labels POLY_PROXY as "recommended" The code-level `TradingMode::default() == Eoa` is intentionally kept (backward compat: existing creds.json files without a `mode` field would otherwise deserialize to PolyProxy with no proxy_wallet and break `buy`/`sell`). This change is docs-only. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
Contributor
✅ Phase 1: Structure Validation — PASSED→ Proceeding to Phase 2: Build Verification |
Contributor
Phase 4: Summary + Pre-flight for
|
| Command | Description |
|---|---|
quickstart |
Check wallet state and get guided next-step command |
check-access |
Verify region is not restricted |
list-markets |
Browse active prediction markets with filtering |
list-5m |
List 5-minute crypto up/down markets |
get-market |
Get market details and order book |
get-positions |
View open positions and P&L |
balance |
Show POL and USDC.e balances for EOA and proxy wallets |
buy |
Buy YES/NO outcome shares |
sell |
Sell outcome shares |
cancel |
Cancel an open order |
redeem |
Redeem winning tokens after market resolves |
setup-proxy |
Deploy proxy wallet for gasless trading |
deposit |
Transfer USDC.e from EOA to proxy wallet |
switch-mode |
Switch default trading mode (eoa/proxy) |
Triggers
An AI agent should activate this skill when users want to trade prediction markets, check Polymarket positions, browse political/sports/crypto betting markets, place bets on future events, or when they mention "polymarket", "prediction market", "bet on", "5-minute market", or related trading terminology.
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Version check (auto-injected)
> **AI Agent Instruction**: Run this version check before executing any commands from this skill. If an update is applied, re-read this SKILL.md before proceeding — the instructions may have changed.
```bash
# Check for skill updates (1-hour cache)
UPDATE_CACHE="$HOME/.plugin-store/update-cache/polymarket-plugin"
CACHE_MAX=3600
LOCAL_VER="0.4.9"
DO_CHECK=true
if [ -f "$UPDATE_CACHE" ]; then
CACHE_MOD=$(stat -f %m "$UPDATE_CACHE" 2>/dev/null || stat -c %Y "$UPDATE_CACHE" 2>/dev/null || echo 0)
NOW=$(date +%s)
AGE=$(( NOW - CACHE_MOD ))
[ "$AGE" -lt "$CACHE_MAX" ] && DO_CHECK=false
fi
if [ "$DO_CHECK" = true ]; then
REMOTE_VER=$(curl -sf --max-time 3 "https://raw.githubusercontent.com/okx/plugin-store/main/skills/polymarket-plugin/plugin.yaml" | grep '^version' | head -1 | tr -d '"' | awk '{print $2}')
if [ -n "$REMOTE_VER" ]; then
mkdir -p "$HOME/.plugin-store/update-cache"
echo "$REMOTE_VER" > "$UPDATE_CACHE"
fi
fi
REMOTE_VER=$(cat "$UPDATE_CACHE" 2>/dev/null || echo "$LOCAL_VER")
if [ "$REMOTE_VER" != "$LOCAL_VER" ]; then
echo "Update available: polymarket-plugin v$LOCAL_VER -> v$REMOTE_VER. Updating..."
npx skills add okx/plugin-store --skill polymarket-plugin --yes --global 2>/dev/null || true
echo "Updated polymarket-plugin to v$REMOTE_VER. Please re-read this SKILL.md."
fiInstall onchainos CLI + Skills (auto-injected)
# 1. Install onchainos CLI
onchainos --version 2>/dev/null || curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | sh
# 2. Install onchainos skills (enables AI agent to use onchainos commands)
npx skills add okx/onchainos-skills --yes --global
# 3. Install plugin-store skills (enables plugin discovery and management)
npx skills add okx/plugin-store --skill plugin-store --yes --globalInstall polymarket-plugin binary + launcher (auto-injected)
# Install shared infrastructure (launcher + update checker, only once)
LAUNCHER="$HOME/.plugin-store/launcher.sh"
CHECKER="$HOME/.plugin-store/update-checker.py"
if [ ! -f "$LAUNCHER" ]; then
mkdir -p "$HOME/.plugin-store"
curl -fsSL "https://raw.githubusercontent.com/okx/plugin-store/main/scripts/launcher.sh" -o "$LAUNCHER" 2>/dev/null || true
chmod +x "$LAUNCHER"
fi
if [ ! -f "$CHECKER" ]; then
curl -fsSL "https://raw.githubusercontent.com/okx/plugin-store/main/scripts/update-checker.py" -o "$CHECKER" 2>/dev/null || true
fi
# Clean up old installation
rm -f "$HOME/.local/bin/polymarket-plugin" "$HOME/.local/bin/.polymarket-plugin-core" 2>/dev/null
# Download binary
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
EXT=""
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-musl" ;;
linux_i686) TARGET="i686-unknown-linux-musl" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-musl" ;;
linux_armv7l) TARGET="armv7-unknown-linux-musleabihf" ;;
mingw*_x86_64|msys*_x86_64|cygwin*_x86_64) TARGET="x86_64-pc-windows-msvc"; EXT=".exe" ;;
mingw*_i686|msys*_i686|cygwin*_i686) TARGET="i686-pc-windows-msvc"; EXT=".exe" ;;
mingw*_aarch64|msys*_aarch64|cygwin*_aarch64) TARGET="aarch64-pc-windows-msvc"; EXT=".exe" ;;
esac
mkdir -p ~/.local/bin
curl -fsSL "https://github.com/okx/plugin-store/releases/download/plugins/polymarket-plugin@0.4.9/polymarket-plugin-${TARGET}${EXT}" -o ~/.local/bin/.polymarket-plugin-core${EXT}
chmod +x ~/.local/bin/.polymarket-plugin-core${EXT}
# Symlink CLI name to universal launcher
ln -sf "$LAUNCHER" ~/.local/bin/polymarket-plugin
# Register version
mkdir -p "$HOME/.plugin-store/managed"
echo "0.4.9" > "$HOME/.plugin-store/managed/polymarket-plugin"Report install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/polymarket-plugin"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"polymarket-plugin","version":"0.4.9"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"polymarket-plugin","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
Contributor
📋 Phase 3: AI Code Review Report — Score: 88/100
1. Plugin Overview
Summary: A Rust CLI plugin that enables trading prediction markets on Polymarket (Polygon chain 137). Supports buying/selling YES/NO outcome tokens, managing positions, bridge deposits, proxy wallet setup for gasless trading, and redeeming winning tokens. Uses onchainos CLI for all wallet signing operations (TEE-protected). Target Users: Users who want to trade prediction markets (sports, politics, crypto, 5-minute up/down) via AI agents with wallet automation. 2. Architecture AnalysisComponents:
Skill Structure: Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
All commands exist in onchainos CLI per source reference. Wallet Operations
External APIs / URLs
Chains Operated On
Overall Permission SummaryThe plugin signs EIP-712 orders via onchainos (TEE-protected), executes on-chain approvals/transfers/redemptions via 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes — all signing and on-chain writes route through onchainos CLI. No direct private key usage. On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detected
Verdict: ✅ Fully CompliantPlugin correctly delegates ALL signing to onchainos CLI. ABI-encoding calldata locally is acceptable — onchainos handles the actual signing and broadcasting. No private key material is handled by the plugin. 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)
No toxic flows detected. Prompt Injection Scan
Result: ✅ Clean Dangerous Operations CheckPlugin involves: transfers (USDC.e), signing (EIP-712 orders), contract calls (approvals, redeem, proxy deploy), broadcasting transactions. SKILL.md has explicit user confirmation steps:
Result: Data Exfiltration RiskAll external requests are to declared Polymarket/DeFiLlama/RPC endpoints. No arbitrary URL fetching. Credentials stored locally at Result: ✅ No Risk Overall Security Rating: 🟡 Medium RiskFinancial plugin with large approval surface (setApprovalForAll grants blanket ERC-1155 approval), reliance on 6. Source Code SecurityLanguage & Build Config
Dependency AnalysisAll dependencies are well-known, maintained crates:
Code Safety Audit
Additional notes:
Does SKILL.md accurately describe what the source code does?Yes — SKILL.md documentation matches implementation. Proxy wallet deployment, approve semantics (exact-amount USDC.e vs blanket setApprovalForAll), fee structure, series markets, bridge flow, and 5-minute trading hours all accurately reflected. Verdict: ✅ Source Safe7. Code ReviewQuality Score: 88/100
Strengths
Issues Found
8. Recommendations
9. Reviewer SummaryOne-line verdict: Well-engineered Rust prediction-market plugin with proper onchainos delegation, strong documentation, and acceptable risk profile for a DeFi trading skill — but heavy reliance on Merge recommendation: Caveats to address or acknowledge:
Generated by Claude AI via Anthropic API — review the full report before approving. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
quickstartsubcommand topolymarket-pluginthat acts as a single-call status probe: it checks CLOB region access, reads EOA + proxy balances, queries open positions, and returns astatus+ ready-to-runnext_command. Designed as the first command an agent (or new user) runs — every other command is dispatched from its output.src/commands/quickstart.rs(303 lines) with a 7-state state machinesrc/commands/mod.rsandsrc/main.rs(listed first in--help)SUMMARY.md: bold section titles → H2, Quick Start rewritten as a status-dispatched checklistSKILL.md: new### quickstartsection with params / output fields / status table / agent flow0.4.8→0.4.9(PATCH, per owner decision) across 4 files + inline SKILL.md refsState machine
Defaults to guiding users toward the gasless proxy flow:
restrictedpolymarket-plugin check-accessactivepolymarket-plugin get-positionsproxy_readypolymarket-plugin list-marketsneeds_depositpolymarket-plugin deposit --amount <N>needs_setuppolymarket-plugin setup-proxylow_balancepolymarket-plugin balanceno_fundspolymarket-plugin balanceMinimum balance threshold:
$5for both EOA and proxy. Default deposit amount: 90 % of EOA USDC.e, floored to cents, clamped ≥ $5.Implementation notes
unwrap_or(...)so a transient RPC failure doesn't abort the command — it still emits guidance based on whatever state it could resolve. Matches thehyperliquid-plugin quickstartpattern. Explicit code comment explains the trade-off.check_clob_access,get_pol_balance,get_usdc_balance,get_positionshelpers.plugin.yamlapi_callsunchanged.--versionreports0.4.9,quickstart --helpshows only the documented--addressflag.Test plan
cargo buildpasses (0 new warnings; 17 pre-existing dead-code warnings unchanged)polymarket-plugin --version→polymarket 0.4.9polymarket-plugin quickstart --helpshows--addressparameterpolymarket-plugin --helplistsquickstartas the first command0.4.8refs remain anywhere in the skill directory🤖 Generated with Claude Code