kamino-lend-plugin
Pass
Audited by Gen Agent Trust Hub on Apr 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches configuration files, an installation shell script, and a platform-specific binary executable from the vendor's official GitHub repositories (
okx/plugin-storeandokx/onchainos-skills). These downloads are used to set up the execution environment for the skill. - [REMOTE_CODE_EXECUTION]: Downloads and executes a shell script (
install.sh) from the vendor's repository by pipingcurloutput tosh. This is performed to bootstrap theonchainosCLI if it is not already present on the system. - [COMMAND_EXECUTION]: The skill executes local commands to manage its installation, including
chmodto set executable permissions andlnfor symlinking the binary. It also frequently invokes theonchainosCLI to perform wallet-related tasks such as checking SOL/SPL balances, retrieving transaction history, and broadcasting signed transactions. - [DATA_EXFILTRATION]: Performs network requests to several external DeFi services including
api.kamino.finance,yields.llama.fi, andapi.jup.ag. These connections are necessary for the skill's primary functions: fetching lending rates, obligation status, and token swap quotes for interest shortfall recovery.
Audit Metadata