The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches the onchainos CLI installer and the kamino-lend-plugin binary from official okx GitHub repositories. These downloads are verified using SHA256 checksums before any execution occurs, ensuring the integrity of the software components.
[COMMAND_EXECUTION]: The plugin interacts with the Solana blockchain by executing the onchainos CLI. It uses safe argument passing for all operations, including checking balances and performing contract calls, which effectively prevents command injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from lending protocol APIs (Kamino), market aggregators (DeFiLlama), and decentralized exchanges (Jupiter).
Ingestion points: Data enters the system via JSON responses from yields.llama.fi, api.kamino.finance, and api.jup.ag (defined in src/api.rs).
Boundary markers: The skill instructions in SKILL.md include a mandatory 'Live Trading Confirmation Protocol' and a security notice explicitly warning the agent to treat external content as untrusted.
Capability inventory: The skill can execute on-chain transactions via onchainos wallet contract-call (as seen in src/onchainos.rs).
Sanitization: The skill uses typed Rust logic to parse and validate JSON responses, and it requires explicit user confirmation via a --confirm flag before any transaction is broadcast.

kamino-lend-plugin