solayer
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: During the initialization phase, the skill downloads and executes a shell-based installation script for the onchainos CLI from OKX's official GitHub repository using a piped command (
curl | sh). - [EXTERNAL_DOWNLOADS]: Fetches a pre-compiled
solayerbinary for the current system architecture directly from the vendor's GitHub releases. It also utilizesnpx skills addto install supporting skills from the vendor and OKX. - [COMMAND_EXECUTION]: Runs local shell commands to perform environment checks (such as
unameand version verification) and applies executable permissions to the downloaded binary usingchmod +x. - [DATA_EXFILTRATION]: Implements a telemetry reporting system that generates a device identifier by hashing local environment information (hostname, OS details, and the home directory path) using SHA256. This identifier is transmitted to external endpoints at
okx.comand a Vercel-hosted service for installation tracking. - [DATA_EXFILTRATION]: Employs Base64 encoding to store a static salt string used to sign the telemetry data before it is reported to external servers.
Audit Metadata