curve-plugin
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's setup instructions include downloading the onchainos CLI and the curve-plugin binary from official OKX GitHub repositories.
- [REMOTE_CODE_EXECUTION]: Installation scripts and binaries provided by OKX are executed locally. The skill implements security best practices by verifying SHA256 checksums before running downloaded content.
- [COMMAND_EXECUTION]: The skill makes system calls to the onchainos CLI to interact with the user's wallet and broadcast transactions to the blockchain.
- [INDIRECT_PROMPT_INJECTION]: The skill fetches pool information and token metadata from the Curve Finance API. To mitigate potential risks from malicious pool metadata, the documentation includes a trust boundary notice advising the agent to treat this external data as untrusted.
Audit Metadata