Decentralized stop-loss orders for DeFi
AdvisoryAudited by Static analysis on May 6, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A wrong or maliciously prepared order could authorize spending tokens up to the order amount.
The skill asks the user to approve token spending and sign typed data that can authorize execution of a DeFi order.
If allowance for `input.token` to `typedData.domain.verifyingContract` is lower than `input.maxAmount`, the default suggestion is a standard ERC-20 `approve(typedData.domain.verifyingContract, input.maxAmount)` transaction first. ... Sign `typedData` ... The signer must equal `swapper`.
Before approving or signing, verify the chain, contract address, input token, input.maxAmount, output token, recipient, deadline, triggers, and slippage. Prefer exact approvals over standing max approvals.
The relay receives wallet address, order details, and a usable signature for the submitted order.
The final signed order and signature are sent to an external relay endpoint.
Submit this exact relay payload to `https://agents-sink.orbs.network/orders/new`: ... `{ "order": "<typedData.message>", "signature": "<full signature or { r, s, v }>", "status": "pending" }`Submit only if you trust the relay and have verified the payload. Do not send signatures or typed data to any endpoint other than the intended relay.
If stored too broadly or reused incorrectly, a signed payload could be replayed for the same order while valid.
The skill recommends retaining a signed order payload, which is sensitive until it expires or is cancelled.
After an ambiguous relay failure such as a timeout or `5xx`, persist and reuse the exact populated `typedData` and signature for any retry.
Store signed payloads only as long as needed for retry or cancellation, keep them out of shared memory/logs, and delete them after resolution.
Users have less registry-level assurance that the included contract addresses and relay endpoint match the intended project.
The registry metadata does not provide a verified source or homepage, which matters because the skill hardcodes protocol contracts and a relay for financial transactions.
Source: unknown Homepage: none
Independently verify the package provenance, protocol documentation, audit, relay endpoint, and contract addresses before using the skill with real funds.