lido-plugin
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches installer scripts and platform-specific binaries from the vendor's official GitHub repositories (
github.com/okx). All downloaded components are verified against SHA256 checksums before installation or execution. - [COMMAND_EXECUTION]: Interacts with the blockchain through the
onchainosCLI. The skill enforces a mandatory 'Live Trading Confirmation Protocol' that requires explicit, typed user confirmation for any on-chain transaction and provides dry-run previews by default. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external APIs (DeFiLlama and Lido) and Ethereum RPC nodes. It includes specific agent instructions to treat this data as untrusted and utilizes structured data parsing in its Rust implementation to mitigate injection risks.
- [SAFE]: The plugin demonstrates strong security hygiene for a DeFi application, including pre-flight balance checks, staking pause verification, and clear separation between simulation and live modes.
Audit Metadata