DefiLlama Yields OpenAPI Skill
v1.0.0Operate DefiLlama public yield APIs through UXC with a curated OpenAPI schema and read-first guardrails.
⭐ 0· 176·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name, description, OpenAPI schema, and instructions consistently describe a read-only wrapper for yields.llama.fi. However, SKILL.md explicitly requires the 'uxc' CLI be present in PATH (and shows linking commands), but the registry metadata lists no required binaries — this is a minor inconsistency (uxc should be declared as a required binary). Otherwise the declared files (schema, usage patterns) match the stated purpose.
Instruction Scope
Runtime instructions are narrowly scoped to read-only operations on yields.llama.fi via uxc and a curated OpenAPI schema. They instruct creating a local uxc link/CLI and running get:/pools and get:/chart/{pool}. There are no instructions to read unrelated files, exfiltrate secrets, or call other endpoints beyond the documented schema and GitHub-hosted schema URL.
Install Mechanism
There is no install spec (instruction-only skill). The only network resources referenced are public: yields.llama.fi and a raw.githubusercontent.com URL for the schema. No downloads of arbitrary archives or obscure hosts are present.
Credentials
The skill requests no environment variables or credentials and the SKILL.md declares the API is public and read-only. There are no unexpected SECRET/TOKEN/PASSWORD requirements or config path access.
Persistence & Privilege
The skill is not marked 'always: true' and does not request system-wide changes. It is user-invocable and allows normal autonomous invocation (platform default). Nothing here indicates elevated or persistent privileges beyond typical skill behavior.
Assessment
This skill appears to do exactly what it says: provide read-only access to DefiLlama yields via uxc and a curated OpenAPI schema. Before installing: (1) confirm you have or trust the 'uxc' CLI (SKILL.md requires it but the metadata didn't list it), (2) verify you are comfortable allowing network access to yields.llama.fi and raw.githubusercontent.com (the schema URL), and (3) review the included references/defillama-yields.openapi.json if you want to verify which endpoints will be called. If you plan to run the included scripts/validate.sh locally, note it requires jq and ripgrep (rg). No credentials are requested and there are no obvious exfiltration steps in the instructions — the mismatch about declaring 'uxc' as a required binary is the only notable inconsistency.Like a lobster shell, security has layers — review code before you run it.
latestvk9789g7qjv1a73jnmbw0qqr0ks833934
License
MIT-0
Free to use, modify, and redistribute. No attribution required.