lido-plugin
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads its core binary, infrastructure scripts, and dependencies from official vendor GitHub repositories (okx organization). Specifically, it fetches the
onchainosinstaller and thelido-pluginbinary, verifying checksums for the installer to ensure file integrity. - [COMMAND_EXECUTION]: The skill executes shell commands to manage its environment, including version checks, dependency installation via the
skillsCLI, and interaction with theonchainoswallet for blockchain transactions. All write operations on-chain require explicit user confirmation via the agent. - [REMOTE_CODE_EXECUTION]: During the setup process, the skill downloads and executes shell scripts from the vendor's GitHub account to install required CLI tools. These operations are judged safe as they target trusted vendor infrastructure and include verification steps.
- [PROMPT_INJECTION]: The skill includes a clear data boundary notice in its instructions, advising the agent to treat data from external APIs and RPC providers as untrusted. This follows security best practices for handling indirect prompt injection surfaces.
Audit Metadata