Spot Advanced Swap Orders

Use for gasless non-custodial EVM market, limit, TWAP, stop-loss, take-profit, delayed-start swaps.

Security Scan

The skill's files and instructions are internally consistent with a non-custodial EVM order relay workflow, but it requires sending user signatures to an external relay URL—verify that endpoint and the referenced contract addresses before use.

Purpose & Capability

The name/description (advanced non-custodial Spot orders) matches the bundled assets and instructions: param mapping, typed-data template, signing guidance, and relay submission. No unrelated binaries, env vars, or config paths are requested. Adapter addresses and supported chains are listed in SKILL.md and assets, which is expected for a multi-chain order builder.

Instruction Scope

The runtime instructions are narrowly scoped to: build/normalize params locally from included markdown/JSON, populate the provided EIP‑712 template, sign locally, and POST the signed payload to a single external relay endpoint (https://agents-sink.orbs.network/orders/new). The SKILL.md explicitly forbids fetching or executing external helper code. Sending signatures to an external relay is expected for this purpose but is an important trust/attack surface to confirm before use.

Install Mechanism

Instruction-only skill with no install spec and no code files to execute. This minimizes disk/write risk; nothing is downloaded or installed by the skill itself.

Credentials

The skill requests no environment variables, keys, or config paths. All signing is described as happening with the user's wallet or local signer, which is proportionate to the stated non-custodial signing workflow.

Persistence & Privilege

No persistent installation, no always:true flag, and no modifications to other skills or agent-wide settings. Autonomous invocation is allowed (platform default) but not combined with other broad privileges.

Assessment

This skill appears coherent for building and submitting non-custodial Spot orders, but before installing or using it you should: (1) verify the relay endpoint (https://agents-sink.orbs.network) is run/endorsed by a party you trust (the repo points to an Orbs Network GitHub, but confirm the relay owner/operator), (2) inspect the typed-data domain.verifyingContract and adapter addresses in the SKILL.md/assets and confirm they match the deployed contracts you expect, (3) always review the exact populated typedData before signing and only sign with a wallet you control (prefer hardware/safe wallets), (4) understand that sending the signature to the relay lets the relay submit the order onchain — if the typedData domain is incorrect or intentionally weak this could be abused, and (5) note that cancellation requires an onchain transaction (gas) from the swapper. If you cannot verify the relay operator or the contract addresses, treat the skill as suspicious and avoid sending real funds/signatures through it.

Use this skill when the agent needs to turn user intent into a final Spot order payload on a supported EVM chain. It covers order-shape selection, param normalization, typed-data population, approval guidance, signing, submission, query, and cancellation. This bundle is instruction-only: build everything locally from the bundled markdown and JSON assets, then send only the final signed payload to https://agents-sink.orbs.network/orders/new. Execution remains decentralized, non-custodial, oracle-protected, immutable, audited, and battle-tested onchain.

Config

{
  "references": [
    "references/quickstart.md",
    "references/params.md",
    "references/sign.md",
    "references/examples.md",
    "references/lifecycle.md"
  ],
  "scripts": [],
  "assets": [
    "assets/token-addressbook.md",
    "assets/repermit.template.json"
  ],
  "runtime": {
    "url": "https://agents-sink.orbs.network",
    "chains": {
      "1": {
        "name": "Ethereum",
        "adapter": "0xC1bB4d5071Fe7109ae2D67AE05826A3fe9116cfc"
      },
      "56": {
        "name": "BNB Chain",
        "adapter": "0x67Feba015c968c76cCB2EEabf197b4578640BE2C"
      },
      "137": {
        "name": "Polygon",
        "adapter": "0x75A3d70Fa6d054d31C896b9Cf8AB06b1c1B829B8"
      },
      "146": {
        "name": "Sonic",
        "adapter": "0x58fD209C81D84739BaD9c72C082350d67E713EEa"
      },
      "8453": {
        "name": "Base",
        "adapter": "0x5906C4dD71D5afFe1a8f0215409E912eB5d593AD"
      },
      "42161": {
        "name": "Arbitrum One",
        "adapter": "0x026B8977319F67078e932a08feAcB59182B5380f"
      },
      "43114": {
        "name": "Avalanche",
        "adapter": "0x4F48041842827823D3750399eCa2832fC2E29201"
      },
      "59144": {
        "name": "Linea",
        "adapter": "0x55E4da2cd634729064bEb294EC682Dc94f5c3f24"
      }
    }
  }
}

Workflow

1. Read references/quickstart.md for the minimum end-to-end flow.
2. Use references/params.md to map user intent into params, defaults, validation, and order-shape fields.
3. Use references/sign.md to fill the template, handle approval, sign, and submit.
4. Use references/lifecycle.md for relay query semantics, status polling, and cancellation.
5. Use references/examples.md only when the final relay payload shape is still unclear.
6. Use assets/token-addressbook.md only for optional token alias lookup on supported chains.
7. Use assets/repermit.template.json as the canonical typed-data shape.
8. Treat the ## Config JSON block in SKILL.md as the authoritative source for supported chains, adapters, and relay URL.

Guardrails

1. The ## Config JSON block in SKILL.md is authoritative for supported chains, per-chain adapters, and relay URL.
2. assets/token-addressbook.md is a convenience alias list only. It does not expand chain support or override explicit user-provided addresses.
3. This skill is instruction-only. Do not fetch or execute external helper code.
4. Normalize params with references/params.md before touching the template.
5. Replace only the <...> placeholders in assets/repermit.template.json. Keep the fixed protocol fields already in the template unchanged.
6. Default approval guidance is exact approve(..., input.maxAmount). Standing maxUint256 approval is opt-in convenience for repeat use, not the default suggestion.
7. Send only the final signed payload to https://agents-sink.orbs.network/orders/new.

Agent Contract

1. Turn the user request into a params JSON object using references/params.md.
2. Normalize params locally, including defaults, rounding, and order-shape fields.
3. Populate assets/repermit.template.json from the normalized params and the adapter for chainId from the generated ## Config JSON block in SKILL.md.
4. Handle approval, signing, and submission exactly as described in references/sign.md, and forward the returned signature unchanged.
5. Query and cancel exactly as described in references/lifecycle.md.