Conversation
`eth_call` and `eth_call_with_gas` previously coerced a missing `result` field to `"0x"`, which decoded to 0 downstream. When an RPC node returned a malformed response (e.g. proxy HTML, truncated JSON), users silently saw zero balances / zero ticks instead of a clear error. Now both helpers return an explicit error containing the full response body when `result` is missing or not a string (EVM-012). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GeoGu360
had a problem deploying
to
summary-generation
GitHub Actions
Error
🔨 Phase 2: Build Verification — ✅ PASSED
Build succeeded. Compiled artifact uploaded as workflow artifact. Source integrity: commit SHA `` is the content fingerprint. |
Replace bold `**Overview**` / `**Prerequisites**` / `**Quick Start**` with `## Overview` / `## Prerequisites` / `## Quick Start` so the section titles render as proper headings in the webview instead of blending into body copy. Docs-only change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GeoGu360
had a problem deploying
to
summary-generation
GitHub Actions
Error
✅ Phase 1: Structure Validation — PASSED→ Proceeding to Phase 2: Build Verification |
…ples The binary installed at `~/.local/bin/` is `pancakeswap-v3-plugin`, not `pancakeswap-v3`. Users copying Quick Start commands verbatim would hit "command not found". Aligns all examples with the actual installed binary name. Docs-only change — no version bump (the v1.0.5 code fix commit stands on its own). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GeoGu360
temporarily deployed
to
summary-generation
GitHub Actions
Inactive
Phase 4: Summary + Pre-flight for
|
| Command | Description |
|---|---|
quote |
Get swap quotes without executing transactions |
swap |
Execute token swaps via SmartRouter |
pools |
List available pools for token pairs |
positions |
View active LP positions for a wallet |
add-liquidity |
Mint new concentrated liquidity positions |
remove-liquidity |
Remove liquidity and collect tokens from positions |
quickstart |
Check wallet status and get onboarding guidance |
Triggers
An AI agent should activate this skill when users mention PancakeSwap operations like "swap on pancakeswap", "add liquidity pancakeswap", "pancakeswap pool", or need DEX functionality on supported chains. It's specifically designed for PancakeSwap V3 concentrated liquidity operations rather than V2 AMM swaps.
Auto-injected Pre-flight
## Pre-flight Dependencies (auto-injected by Plugin Store CI)
> Run once per session before first use. These checks ensure required tools are installed.
### Version check (auto-injected)
> **AI Agent Instruction**: Run this version check before executing any commands from this skill. If an update is applied, re-read this SKILL.md before proceeding — the instructions may have changed.
```bash
# Check for skill updates (1-hour cache)
UPDATE_CACHE="$HOME/.plugin-store/update-cache/pancakeswap-v3-plugin"
CACHE_MAX=3600
LOCAL_VER="1.0.5"
DO_CHECK=true
if [ -f "$UPDATE_CACHE" ]; then
CACHE_MOD=$(stat -f %m "$UPDATE_CACHE" 2>/dev/null || stat -c %Y "$UPDATE_CACHE" 2>/dev/null || echo 0)
NOW=$(date +%s)
AGE=$(( NOW - CACHE_MOD ))
[ "$AGE" -lt "$CACHE_MAX" ] && DO_CHECK=false
fi
if [ "$DO_CHECK" = true ]; then
REMOTE_VER=$(curl -sf --max-time 3 "https://raw.githubusercontent.com/okx/plugin-store/main/skills/pancakeswap-v3-plugin/plugin.yaml" | grep '^version' | head -1 | tr -d '"' | awk '{print $2}')
if [ -n "$REMOTE_VER" ]; then
mkdir -p "$HOME/.plugin-store/update-cache"
echo "$REMOTE_VER" > "$UPDATE_CACHE"
fi
fi
REMOTE_VER=$(cat "$UPDATE_CACHE" 2>/dev/null || echo "$LOCAL_VER")
if [ "$REMOTE_VER" != "$LOCAL_VER" ]; then
echo "Update available: pancakeswap-v3-plugin v$LOCAL_VER -> v$REMOTE_VER. Updating..."
npx skills add okx/plugin-store --skill pancakeswap-v3-plugin --yes --global 2>/dev/null || true
echo "Updated pancakeswap-v3-plugin to v$REMOTE_VER. Please re-read this SKILL.md."
fiInstall onchainos CLI + Skills (auto-injected)
# 1. Install onchainos CLI
onchainos --version 2>/dev/null || curl -fsSL https://raw.githubusercontent.com/okx/onchainos-skills/main/install.sh | sh
# 2. Install onchainos skills (enables AI agent to use onchainos commands)
npx skills add okx/onchainos-skills --yes --global
# 3. Install plugin-store skills (enables plugin discovery and management)
npx skills add okx/plugin-store --skill plugin-store --yes --globalInstall pancakeswap-v3-plugin binary + launcher (auto-injected)
# Install shared infrastructure (launcher + update checker, only once)
LAUNCHER="$HOME/.plugin-store/launcher.sh"
CHECKER="$HOME/.plugin-store/update-checker.py"
if [ ! -f "$LAUNCHER" ]; then
mkdir -p "$HOME/.plugin-store"
curl -fsSL "https://raw.githubusercontent.com/okx/plugin-store/main/scripts/launcher.sh" -o "$LAUNCHER" 2>/dev/null || true
chmod +x "$LAUNCHER"
fi
if [ ! -f "$CHECKER" ]; then
curl -fsSL "https://raw.githubusercontent.com/okx/plugin-store/main/scripts/update-checker.py" -o "$CHECKER" 2>/dev/null || true
fi
# Clean up old installation
rm -f "$HOME/.local/bin/pancakeswap-v3-plugin" "$HOME/.local/bin/.pancakeswap-v3-plugin-core" 2>/dev/null
# Download binary
OS=$(uname -s | tr A-Z a-z)
ARCH=$(uname -m)
EXT=""
case "${OS}_${ARCH}" in
darwin_arm64) TARGET="aarch64-apple-darwin" ;;
darwin_x86_64) TARGET="x86_64-apple-darwin" ;;
linux_x86_64) TARGET="x86_64-unknown-linux-musl" ;;
linux_i686) TARGET="i686-unknown-linux-musl" ;;
linux_aarch64) TARGET="aarch64-unknown-linux-musl" ;;
linux_armv7l) TARGET="armv7-unknown-linux-musleabihf" ;;
mingw*_x86_64|msys*_x86_64|cygwin*_x86_64) TARGET="x86_64-pc-windows-msvc"; EXT=".exe" ;;
mingw*_i686|msys*_i686|cygwin*_i686) TARGET="i686-pc-windows-msvc"; EXT=".exe" ;;
mingw*_aarch64|msys*_aarch64|cygwin*_aarch64) TARGET="aarch64-pc-windows-msvc"; EXT=".exe" ;;
esac
mkdir -p ~/.local/bin
curl -fsSL "https://github.com/okx/plugin-store/releases/download/plugins/pancakeswap-v3-plugin@1.0.5/pancakeswap-v3-plugin-${TARGET}${EXT}" -o ~/.local/bin/.pancakeswap-v3-plugin-core${EXT}
chmod +x ~/.local/bin/.pancakeswap-v3-plugin-core${EXT}
# Symlink CLI name to universal launcher
ln -sf "$LAUNCHER" ~/.local/bin/pancakeswap-v3-plugin
# Register version
mkdir -p "$HOME/.plugin-store/managed"
echo "1.0.5" > "$HOME/.plugin-store/managed/pancakeswap-v3-plugin"Report install (auto-injected, runs once)
REPORT_FLAG="$HOME/.plugin-store/reported/pancakeswap-v3-plugin"
if [ ! -f "$REPORT_FLAG" ]; then
mkdir -p "$HOME/.plugin-store/reported"
# Device fingerprint → SHA256 → 32-char device ID
DEV_RAW="$(hostname):$(uname -s):$(uname -m):$HOME"
DEV_ID=$(echo -n "$DEV_RAW" | shasum -a 256 | head -c 32)
# HMAC signature (obfuscated key, same as CLI binary)
_K=$(echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | base64 -d 2>/dev/null || echo 'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw==' | openssl base64 -d)
HMAC_SIG=$(echo -n "${_K}${DEV_ID}" | shasum -a 256 | head -c 8)
DIV_ID="${DEV_ID}${HMAC_SIG}"
unset _K
# Report to Vercel stats
curl -s -X POST "https://plugin-store-dun.vercel.app/install" \
-H "Content-Type: application/json" \
-d '{"name":"pancakeswap-v3-plugin","version":"1.0.5"}' >/dev/null 2>&1 || true
# Report to OKX API (with HMAC-signed device token)
curl -s -X POST "https://www.okx.com/priapi/v1/wallet/plugins/download/report" \
-H "Content-Type: application/json" \
-d '{"pluginName":"pancakeswap-v3-plugin","divId":"'"$DIV_ID"'"}' >/dev/null 2>&1 || true
touch "$REPORT_FLAG"
fi
</details>
---
*Generated by Plugin Store CI after maintainer approval.*
📋 Phase 3: AI Code Review Report — Score: 87/100
1. Plugin Overview
Summary: A Rust-based plugin that enables token swaps and concentrated liquidity management on PancakeSwap V3 across Ethereum, BNB Chain, Base, Arbitrum, and Linea. It provides quote/swap/pools/positions/add-liquidity/remove-liquidity/quickstart commands, calling smart contracts via Target Users: DeFi users who want to interact with PancakeSwap V3 via an AI agent — swapping tokens, providing concentrated liquidity, and managing LP positions across multiple EVM chains. 2. Architecture AnalysisComponents: Skill Structure: Data Flow:
Dependencies:
3. Auto-Detected Permissionsonchainos Commands Used
Wallet Operations
External APIs / URLs
Chains Operated OnEthereum (1), BNB Chain (56), Base (8453), Arbitrum One (42161), Linea (59144). Note: plugin.yaml tags mention BNB, Base, Arbitrum but skill supports Ethereum + Linea too (fixed in v1.0.4 api_calls). Overall Permission SummaryThis plugin can read token balances and pool state from public RPCs, query TheGraph for LP positions, and delegate transaction signing/broadcasting to 4. onchainos API ComplianceDoes this plugin use onchainos CLI for all on-chain write operations?Yes — all signing and broadcasting go through On-Chain Write Operations (MUST use onchainos)
Data Queries (allowed to use external sources)
External APIs / Libraries DetectedDirect RPC via reqwest; no web3 library. TheGraph GraphQL endpoints. All endpoints declared in plugin.yaml Verdict: ✅ Fully CompliantAll write operations correctly delegate to 5. Security AssessmentStatic Rule Scan (C01-C09, H01-H09, M01-M08, L01-L02)
No other static rules match. The auto-injected preflight curl|sh is excluded per review policy. LLM Judge Analysis (L-PINJ, L-MALI, L-MEMA, L-IINJ, L-AEXE, L-FINA, L-FISO)
Toxic Flow Detection (TF001-TF006)No toxic flows detected. H05 (financial) present but M07 not triggered (boundary declaration exists), and no C01 (curl|sh in agent path), so TF005/TF006 do not fire. Prompt Injection ScanChecked for instruction override, identity manipulation, hidden behavior, base64 payloads, HTML comments, invisible chars — none found. The only base64 in scope is in the auto-injected preflight (skipped). Result: ✅ Clean Dangerous Operations CheckWrite ops (approve/swap/mint/decrease/collect) are gated:
SKILL.md enforces: "Always obtain explicit user approval before passing --confirm." However, the Result: ✅ Safe Data Exfiltration RiskAll outbound network calls go to declared public RPC/subgraph endpoints. No environment variable reads, no home directory access, no hidden POST to unknown hosts. Wallet address fetched via Result: ✅ No Risk Overall Security Rating: 🟢 Low Risk6. Source Code SecurityLanguage & Build ConfigRust, entry point src/main.rs, binary name Dependency Analysis
No suspicious or unmaintained dependencies. No git dependencies, no path dependencies to local forks. Code Safety Audit
Subprocess argument construction review: In Does SKILL.md accurately describe what the source code does?Yes. SKILL.md commands map 1:1 to source modules (commands/quote.rs, swap.rs, pools.rs, positions.rs, add_liquidity.rs, remove_liquidity.rs, quickstart.rs). Documented flow (quote → preview → approve → swap, with receipt verification) matches implementation. Changelog entries correspond to actual code fixes visible in source (e.g., v1.0.5 RPC error handling in Verdict: ✅ Source Safe7. Code ReviewQuality Score: 87/100
Strengths
Issues Found
8. Recommendations
9. Reviewer SummaryOne-line verdict: Well-engineered multi-chain PancakeSwap V3 plugin that correctly delegates signing to onchainos, includes strong safety gates (dry-run, --confirm, receipt verification, V3-math slippage), with only minor documentation inconsistencies. Merge recommendation: ✅ Ready to merge Minor follow-ups (non-blocking):
Generated by Claude AI via Anthropic API — review the full report before approving. |
2 participants
Summary
eth_callandeth_call_with_gasinrpc.rspreviously usedresp["result"].as_str().unwrap_or("0x"), silently coercing a missingresultfield into an empty hex string that decoded to0downstream. When an RPC node misbehaved (proxy HTML, truncated JSON, non-standard shape), users saw zero balances / zero ticks with no error — a classic EVM-012 silent-failure pattern.Now both helpers return an explicit
anyhow::anyhow!error that includes the full RPC response body, making the root cause visible instead of silently misleading the caller.Changes
src/rpc.rs:42—eth_callnow errors on missingresultfieldsrc/rpc.rs:65—eth_call_with_gassame fix1.0.4→1.0.5(patch) acrossplugin.yaml/Cargo.toml/SKILL.md/plugin.jsonRisk assessment
Zero functional-logic changes. The fallback
"0x"was only reachable when the RPC response itself was malformed — a well-formed node always returnsresult: string. Previously malformed responses produced misleading zero values; they now produce a clear error. No regression risk for healthy nodes.Test plan
cargo buildcleancargo buildproduces binary reportingv1.0.5🤖 Generated with Claude Code