Conversation
…(v0.2.7) Minimal quickstart that reuses existing `rpc::get_balance_of` and `rpc::get_borrow_balance_of` (no new RPC helpers, no new external domains). Emits a single JSON with `status`, `suggestion`, and a ready-to-run `next_command`. Three-state machine (per (chain, market) pair): - borrowed — borrow_balance > 0 → get-position then repay - earning — supply_balance > 0, borrow = 0 → get-position - new_user — neither → get-markets No native-gas / base-asset-wallet-balance checks in this first pass to keep scope small; users still get clear guidance based on their on-chain Comet position. Also: - SUMMARY.md: convert `**X**` bold section titles to `## X` H2 for proper webview rendering; rewrite Quick Start to lead with `compound-v3-plugin quickstart` and branch by status. - SKILL.md: add `### quickstart` command section (params / output / status table / agent flow); bump 5 inline 0.2.6 references. - Version bump: 0.2.6 -> 0.2.7 (PATCH, new command). No changes to existing commands' logic. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
Phase 4: Summary + Pre-flight for
|
| Command | Purpose |
|---|---|
compound-v3 quickstart |
Check account status and get personalized next steps |
compound-v3 get-markets |
View current market rates and statistics |
compound-v3 get-position |
Check supply/borrow balances and collateral health |
compound-v3 supply --asset ADDRESS --amount X |
Supply collateral or base asset to earn yield |
compound-v3 borrow --amount X |
Borrow base asset against supplied collateral |
compound-v3 repay [--amount X] |
Repay borrowed funds (defaults to full repayment) |
compound-v3 withdraw --asset ADDRESS --amount X |
Withdraw supplied collateral (requires zero debt) |
compound-v3 claim-rewards |
Claim accrued COMP token rewards |
Triggers
Activate when users mention Compound lending activities, DeFi yield farming, borrowing against crypto collateral, or need to check lending positions. Also trigger for phrases like "compound supply", "compound borrow", "compound rewards", or "lending rates".
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Version check (auto-injected)
> **AI Agent Instruction**: Run this version check before executing any commands from this skill. If an update is applied, re-read this SKILL.md before proceeding — the instructions may have changed.
```bash
# Check for skill updates (1-hour cache)
UPDATE_CACHE="$HOME/.plugin-store/update-cache/compound-v3-plugin"
CACHE_MAX=3600
LOCAL_VER="0.2.7"
DO_CHECK=true
if [ -f "$UPDATE_CACHE" ]; then
CACHE_MOD=$(stat -f %m "$UPDATE_CACHE" 2>/dev/null || stat -c %Y "$UPDATE_CACHE" 2>/dev/null || echo 0)
NOW=$(date +%s)
AGE=$(( NOW - CACHE_MOD ))
[ "$AGE" -lt "$CACHE_MAX" ] && DO_CHECK=false
fi
if [ "$DO_CHECK" = true ]; then
REMOTE_VER=$(curl -sf --max-time 3 "https://raw.githubusercontent.com/okx/plugin-store/main/skills/compound-v3-plugin/plugin.yaml" | grep '^version' | head -1 | tr -d '"' | awk '{print $2}')
if [ -n "$REMOTE_VER" ]; then
mkdir -p "$HOME/.plugin-store/update-cache"
echo "$REMOTE_VER" > "$UPDATE_CACHE"
fi
fi
REMOTE_VER=$(cat "$UPDATE_CACHE" 2>/dev/null || echo "$LOCAL_VER")
if [ "$REMOTE_VER" != "$LOCAL_VER" ]; then
echo "Update available: compound-v3-plugin v$LOCAL_VER -> v$REMOTE_VER. Updating..."
npx skills add okx/plugin-store --skill compound-v3-plugin --yes --global 2>/dev/null || true
echo "Updated compound-v3-plugin to v$REMOTE_VER. Please re-read this SKILL.md."
fiInstall onchainos CLI + Skills (auto-injected)
# 1. Install onchainos CLI
onchainos --version 2>/dev/null || curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | sh
# 2. Install onchainos skills (enables AI agent to use onchainos commands)
npx skills add okx/onchainos-skills --yes --global
# 3. Install plugin-store skills (enables plugin discovery and management)
npx skills add okx/plugin-store --skill plugin-store --yes --globalInstall compound-v3-plugin binary + launcher (auto-injected)
# Install shared infrastructure (launcher + update checker, only once)
LAUNCHER="$HOME/.plugin-store/launcher.sh"
CHECKER="$HOME/.plugin-store/update-checker.py"
if [ ! -f "$LAUNCHER" ]; then
mkdir -p "$HOME/.plugin-store"
curl -fsSL "https://raw.githubusercontent.com/okx/plugin-store/main/scripts/launcher.sh" -o "$LAUNCHER" 2>/dev/null || true
chmod +x "$LAUNCHER"
fi
if [ ! -f "$CHECKER" ]; then
curl -fsSL "https://raw.githubusercontent.com/okx/plugin-store/main/scripts/update-checker.py" -o "$CHECKER" 2>/dev/null || true
fi
# Clean up old installation
rm -f "$HOME/.local/bin/compound-v3-plugin" "$HOME/.local/bin/.compound-v3-plugin-core" 2>/dev/null
# Download binary
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
EXT=""
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-musl" ;;
linux_i686) TARGET="i686-unknown-linux-musl" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-musl" ;;
linux_armv7l) TARGET="armv7-unknown-linux-musleabihf" ;;
mingw*_x86_64|msys*_x86_64|cygwin*_x86_64) TARGET="x86_64-pc-windows-msvc"; EXT=".exe" ;;
mingw*_i686|msys*_i686|cygwin*_i686) TARGET="i686-pc-windows-msvc"; EXT=".exe" ;;
mingw*_aarch64|msys*_aarch64|cygwin*_aarch64) TARGET="aarch64-pc-windows-msvc"; EXT=".exe" ;;
esac
mkdir -p ~/.local/bin
curl -fsSL "https://github.com/okx/plugin-store/releases/download/plugins/compound-v3-plugin@0.2.7/compound-v3-plugin-${TARGET}${EXT}" -o ~/.local/bin/.compound-v3-plugin-core${EXT}
chmod +x ~/.local/bin/.compound-v3-plugin-core${EXT}
# Symlink CLI name to universal launcher
ln -sf "$LAUNCHER" ~/.local/bin/compound-v3-plugin
# Register version
mkdir -p "$HOME/.plugin-store/managed"
echo "0.2.7" > "$HOME/.plugin-store/managed/compound-v3-plugin"Report install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/compound-v3-plugin"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"compound-v3-plugin","version":"0.2.7"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"compound-v3-plugin","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
📋 Phase 3: AI Code Review Report — Score: 88/100
1. Plugin Overview
Summary: A Rust-based plugin for interacting with Compound V3 (Comet) lending protocol across Ethereum, Base, Arbitrum, and Polygon. It supports supplying collateral, borrowing/repaying the base asset, withdrawing collateral, and claiming COMP rewards. Signing/broadcasting is delegated to Target Users: DeFi users who want to manage Compound V3 positions through an AI agent, with preview-first ( 2. Architecture AnalysisComponents:
Skill Structure: Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
All commands verified against the onchainos CLI source reference. Wallet Operations
External APIs / URLs
Chains Operated OnEthereum (1), Base (8453), Arbitrum One (42161), Polygon (137). Overall Permission SummaryThis plugin can read Compound V3 market/position state and submit on-chain transactions (approve, supply, withdraw/borrow, claim rewards) by constructing ABI-encoded calldata and delegating signing to onchainos. Wallet private keys never touch this binary. All writes are gated by 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes — all signing and broadcasting is routed through On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries Detectedreqwest HTTP client → JSON-RPC to publicnode endpoints. No web3 library, no private-key handling libraries. Verdict: ✅ Fully CompliantAll write paths correctly delegate to onchainos; no private key handling, no direct tx broadcasting. 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
No other static rules matched. LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)No toxic flows detected. No C01 present in developer code, no TF005. Data boundary declaration present, no TF006. Prompt Injection ScanNo instruction override patterns, no pseudo-system tags, no hidden base64 payloads, no Unicode smuggling. SKILL.md contains legitimate security directives and confirmation gates. Result: ✅ Clean Dangerous Operations CheckPlugin performs token approvals, supplies, borrows, repays, withdraws, and reward claims. All write commands require Result: ✅ Safe Data Exfiltration RiskNo code paths read ~/.ssh, ~/.aws, ~/.env, or any credentials. No network requests outside the declared public RPC endpoints. Wallet address is the only user data sent externally (as part of eth_call params, which is expected). Result: ✅ No Risk Overall Security Rating: 🟢 Low Risk6. Source Code SecurityLanguage & Build ConfigRust, edition 2021, binary name Dependency Analysis
Code Safety Audit
Minor note: Does SKILL.md accurately describe what the source code does?Yes. The SKILL.md command descriptions (preview vs --confirm, approve+supply 2-tx flow, 3s nonce safety delay, borrow=withdraw semantics, repay overflow protection via min(borrow,wallet), withdraw-requires-zero-debt check) all match the Rust implementation exactly. Verdict: ✅ Source Safe7. Code ReviewQuality Score: 88/100
Strengths
Issues Found
8. Recommendations
9. Reviewer SummaryOne-line verdict: Well-designed Compound V3 plugin with strong safety defaults, correct onchainos delegation for all writes, and no security concerns in developer-submitted code. Merge recommendation: ✅ Ready to merge Generated by Claude AI via Anthropic API — review the full report before approving. |
2 participants
Summary
Two small changes, bundled:
Add
quickstartcommand (new filesrc/commands/quickstart.rs)rpc::get_balance_ofandrpc::get_borrow_balance_of— no new RPC helpers, no new external domains, no changes to any existing command(chain, market)pair, emits a single JSON with ready-to-runnext_commandSUMMARY.md — bold section titles → H2 for proper webview rendering; Quick Start rewritten to lead with
quickstartState machine
borrowedborrow_balance > 0get-position --collateral-asset <X>→repayearningsupply_balance > 0 && borrow = 0get-positionnew_userget-marketsExplicitly not included in this first pass (to keep scope small):
is_borrow_collateralized/ liquidation-risk checkScope
src/commands/quickstart.rs(~110 lines)src/commands/mod.rs:+1src/main.rs:+10(new variant + dispatch)SUMMARY.md:** → ##× 3, rewrite Quick StartSKILL.md: new### quickstartsection; bump 5 inline0.2.6 → 0.2.7refs0.2.6 → 0.2.7(PATCH) acrossplugin.yaml,Cargo.toml,.claude-plugin/plugin.json,SKILL.mdfrontmatterZero changes to any existing command's code.
Test plan
cargo buildpasses with 0 new warnings (3 pre-existing dead-code warnings unchanged)compound-v3-plugin --versionreportscompound-v3 0.2.7compound-v3-plugin quickstart --helpshows--walletplus the global--chain/--marketflagsquickstartappears first incompound-v3-plugin --helpoutput0.2.6refs remainunwrap_or(0)EVM-012 violations (bothunwrap_or(0)in quickstart.rs are intentional RPC-tolerance per hyperliquid/polymarket quickstart pattern)🤖 Generated with Claude Code