okx · skylavis-sky · May 18, 2026
diff --git a/skills/lista-lending-onchainos/FILL-IN.md b/skills/lista-lending-onchainos/FILL-IN.md
@@ -0,0 +1,49 @@
+# FILL-IN — lista-lending-onchainos v0.3.0
+
+Status: **all 12 tools implemented; ready for v1.8 G1+G2 audit gates.**
+
+v0.3.0 restores feature parity with the upstream `lista-lending` v0.1.1 CLI (12 commands), repackaged per v1.8 scaffold spec. Business logic preserved verbatim from v0.1.6 (live-validated on BSC mainnet 2026-05-11).
+
+## Transaction tools (6)
+
+| Tool | Description | Multi-step? | A7 (decimals validated) | A8 (native balance gate) |
+|---|---|---|---|---|
+| `buildDeposit` | Vault deposit (ERC-4626 `deposit`) | Yes — approve then deposit | Structural PASS — decimals SDK-derived from `vaultInfo.assetInfo.decimals` | N/A (value=0 always) |
+| `buildWithdraw` | Vault withdraw (ERC-4626 `redeem`) | No | Structural PASS | N/A |
+| `buildSupply` | Market collateral supply | Yes — approve then supply | Structural PASS — decimals from `marketConfig.collateral.decimals` | N/A |
+| `buildBorrow` | Market loan-token borrow | No | Structural PASS — decimals from `marketConfig.loan.decimals` | N/A |
+| `buildRepay` | Market debt repay | Yes — approve then repay | Structural PASS | N/A |
+| `buildMarketWithdraw` | Market collateral withdraw | No | Structural PASS | N/A |
+
+**Why A7 is structural PASS**: index.ts never invokes `parseUnits(amount, params.X)`. Decimals always come from SDK-fetched `vaultInfo.assetInfo.decimals` / `marketConfig.collateral.decimals` / `marketConfig.loan.decimals` — local variables, not user-passed.
+
+**Why A8 is structural N/A**: Lista lending operations are all ERC-20 token flows on the vault/market contract; the user-signed tx never carries native value. `unsigned_tx.value` is always emitted as `'0'` (or `step.params.value.toString()` which is `'0'` from the SDK).
+
+## Read-only tools (6)
+
+| Tool | Description | Source |
+|---|---|---|
+| `listVaults` | Curated vault catalog per chain | SDK `listVaults(chainId)` |
+| `listMarkets` | Active markets per chain (filters SmartLending zone=3 + fixed-term termType=1) | SDK `listMarkets(chainId)` |
+| `getHoldings` | User's vault + market positions across chains | Lista API (note: 30-60s indexer lag) |
+| `getVaultPosition` | User's direct ERC-4626 share balance + asset equivalent | viem `balanceOf` + `convertToAssets` (no indexer lag) |
+| `simulateBorrow` | Pre-execution: max borrowable / health impact for a `(market, supply, borrow)` triple | SDK `simulateBorrow(...)` |
+| `simulateRepay` | Pre-execution: health impact of partial/full repay | SDK `simulateRepay(...)` |
+
+## v0.3.0 cross-cutting checklist (v1.8 conformance)
+
+- [x] No user-passed decimals — all SDK-derived (A7 structural PASS)
+- [x] No non-zero `unsigned_tx.value` for any lending tool (A8 N/A)
+- [x] No local-signing residue (A4 PASS — verified with expanded keyword set)
+- [x] `pending_sign` contract present for every write tool (A5 PASS)
+- [x] 3 fixed SKILL.md sections present: `[Onchain OS dependency]`, `[signing constraint]`, `## Pre-flight Checks`, `## Signing Constraint` (A3 PASS)
+- [x] Frontmatter merged from source — `name`, `version`, `repository`, `chains`, `requires`, `node`, `requiredTools`, `author`, `description` (Step 3a v1.4 merge rules)
+- [x] Mandatory G1 (`explore-plugin`) + G2 (`test-skill`) gates per P0-9 — see QA-PIPELINE.md
+- [x] Validators: `resolveChain`, `validatePositiveAmount`, `validateEvmAddress`, `validateMarketId`, `safeSdkCall` (lista-specific helpers in index.ts, predating the v1.8 generic helpers but functionally equivalent)
+- [x] PUBLIC_RPCS pinned via `runtime.ts` — defaults to publicnode endpoints, overridable via `LISTA_RPC_*` env vars
+
+## Roadmap (post-v0.3.0)
+
+- [ ] Add explicit `validateDecimals` / `nativeBalanceCheck` / `lc()` from v1.8 generic helper set for forward-compat with future scaffold auto-checks (no functional change; just upgrades A7/A8 from structural-PASS to mechanical-PASS)
+- [ ] Re-add `select` as a state-mutation tool if user feedback shows the explicit-param model is too verbose
+- [ ] Optional: SmartLending zone=3 + fixed-term termType=1 market support (currently out of scope per source SKILL.md "Temporary Limitations")
diff --git a/skills/lista-lending-onchainos/LICENSE b/skills/lista-lending-onchainos/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OKX
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/skills/lista-lending-onchainos/QA-PIPELINE.md b/skills/lista-lending-onchainos/QA-PIPELINE.md
@@ -0,0 +1,74 @@
+# QA pipeline for lista-lending-onchainos v0.3.0
+
+Two MANDATORY gates per v1.8 scaffold spec (P0-9). Live broadcast (G3) is opt-in.
+
+| Step | Skill | Live funds? | Required? | Pass criterion |
+|---|---|---|---|---|
+| **G1. UX exploration** | `explore-plugin` | ❌ no | **MANDATORY** | No Major+ findings, or patched in same pass |
+| **G2. Structured audit** | `test-skill` (language-agnostic) | ❌ no | **MANDATORY** | No Critical/Major findings, or patched + retested |
+| G3. Live broadcast | `test-skill --live` | ✅ yes | OPT-IN | All write tools execute end-to-end |
+
+> Note: `test-skill` replaces `test-plugin` for any scaffold output. The scaffold produces a tsx-based TypeScript Skill, and `test-skill`'s Phase −1 (Skill Invocation Profile detection) auto-adapts to that runtime.
+
+## A1-A8 self-check expectations
+
+| Check | Expected | Why |
+|---|---|---|
+| A1 (no unresolved template placeholders) | PASS | All templates substituted at copy time |
+| A2 (valid YAML frontmatter) | PASS | Hand-validated v1.8 merge |
+| A3 (3 fixed sections present) | PASS | `[Onchain OS dependency]`, `[signing constraint]`, `## Pre-flight Checks`, `## Signing Constraint` |
+| A4 (no local-signing residue) | PASS | All wallet flows route through `next_action.tool` |
+| A5 (pending_sign contract) | PASS | All 6 build* tools emit the contract |
+| A6 (version sync) | PASS | SKILL.md `0.3.0` == package.json `0.3.0` |
+| A7 (parseUnits decimals validated) | PASS | All decimals SDK-derived locals — no `parseUnits(_, params.X)` |
+| A8 (native balance check on non-zero value) | SKIP or PASS | Lista lending operations are ERC-20 token flows; `unsigned_tx.value` is always `'0'` |
+
+## Build smoke (no live funds)
+
+```bash
+cd ~/Documents/dapp-scaffold-work/lista-onchainos
+npm install
+npx tsx cli.ts --version
+npx tsx cli.ts --help
+LISTA_RUNTIME=mock npx tsx cli.ts listVaults '{"chain":"bsc"}'
+```
+
+## B-real read-only smoke (no funds; real RPC)
+
+```bash
+# vault list from real SDK
+npx tsx cli.ts listVaults '{"chain":"bsc"}'
+
+# vault position (replace 0xWALLET with any BSC address)
+npx tsx cli.ts getVaultPosition '{"chain":"bsc","vaultAddress":"0x9a83cf80fb1d0d5e90547fef6d56b3afa7cdce4d","walletAddress":"0xee385ac7ac70b5e7f12aa49bf879a441bed0bae9"}'
+
+# market list
+npx tsx cli.ts listMarkets '{"chain":"bsc"}'
+
+# user holdings (note: Lista API can lag 30-60s behind on-chain state)
+npx tsx cli.ts getHoldings '{"chain":"bsc","address":"0xee385ac7ac70b5e7f12aa49bf879a441bed0bae9"}'
+
+# simulate borrow (read-only — no tx emitted)
+npx tsx cli.ts simulateBorrow '{"chain":"bsc","marketId":"0xd384584abf6504425c9873f34a63372625d46cd1f2e79aeedc77475cacaca922","walletAddress":"0xee385ac7ac70b5e7f12aa49bf879a441bed0bae9"}'
+```
+
+## G3 (opt-in) — live broadcast smoke
+
+Requires a funded `onchainos wallet` on BSC. Reproduces the 2026-05-11 v0.1.6 live validation flow.
+
+```bash
+# 1. Confirm wallet is funded
+onchainos wallet balance --chain bsc
+
+# 2. Build approve+deposit pending_sign (Step 1 of 2)
+npx tsx cli.ts buildDeposit '{"chain":"bsc","vaultAddress":"0x9a83cf80fb1d0d5e90547fef6d56b3afa7cdce4d","amount":"1","walletAddress":"0xYOUR_ADDR"}'
+# → returns approve pending_sign; sign via onchainos wallet contract-call
+
+# 3. After approve tx lands, re-invoke for the deposit step
+npx tsx cli.ts buildDeposit '{"chain":"bsc","vaultAddress":"0x9a83cf80fb1d0d5e90547fef6d56b3afa7cdce4d","amount":"1","walletAddress":"0xYOUR_ADDR"}'
+# → returns deposit pending_sign; sign via onchainos wallet contract-call
+
+# 4. After deposit lands, withdraw
+npx tsx cli.ts buildWithdraw '{"chain":"bsc","vaultAddress":"0x9a83cf80fb1d0d5e90547fef6d56b3afa7cdce4d","amount":"1","walletAddress":"0xYOUR_ADDR"}'
+# → returns redeem pending_sign; sign via onchainos wallet contract-call
+```
diff --git a/skills/lista-lending-onchainos/README.md b/skills/lista-lending-onchainos/README.md
@@ -0,0 +1,73 @@
+# lista-lending-onchainos
+
+View and operate Lista Lending vaults/markets.
+
+Supported chains: bsc, ethereum
+
+## Install
+
+```bash
+npx skills add <your-org>/lista-lending-onchainos
+```
+
+This skill requires Onchain OS. On first use, the LLM will automatically run the install command in `## Pre-flight Checks`:
+
+```bash
+npx skills add okx/onchainos-skills
+```
+
+> Once published to the OKX Skills Marketplace, end users can install with a single `npx skills add` command. Until then, install via `git clone` or `cp -r` into `~/.agents/skills/lista-lending-onchainos/`.
+
+## First-time authentication (email wallet creation)
+
+All on-chain signing is handled by Onchain OS inside a local TEE. This DApp never touches private keys or persists login state.
+
+### Option A — Email OTP (recommended for individual users)
+
+Onchain OS guides you through login on first signing call:
+
+```bash
+onchainos wallet login user@example.com     # sends OTP
+onchainos wallet verify <6-digit-code>      # completes login
+onchainos wallet status                     # confirm loggedIn: true
+```
+
+### Option B — API Key (automation / backend / CI)
+
+```bash
+export OKX_API_KEY=<your API Key>
+export OKX_SECRET_KEY=<your Secret Key>
+export OKX_PASSPHRASE=<your Passphrase>
+onchainos wallet login
+```
+
+> To obtain credentials, visit the OKX Developer Portal (link provided by the technical team).
+
+## Usage example
+
+Trigger tools with natural language in your Agent:
+
+> User: Deposit 100 USDT into the Lista vault at 0xfa27f172e0b6ebcef9c51abf817e2cb142fbe627
+
+The Agent follows this flow:
+
+1. Calls the DApp tool to construct `unsigned_tx`
+2. Tool returns `pending_sign` + `next_action.tool = 'onchainos wallet contract-call'`
+3. Agent routes to Onchain OS `onchainos wallet contract-call`
+4. Onchain OS signs + broadcasts inside the TEE and returns `txHash`
+
+## Security
+
+- This DApp never reads, stores, or transmits the user's private key, seed phrase, or keystore
+- All `pending_sign` transactions are signed exclusively through Onchain OS
+- `ethers.Wallet`, `signTransaction`, and `sendTransaction` are forbidden as alternative signing paths
+
+## Migration notes
+
+This is an Onchain-OS-integrated version of the original `lista-lending` skill (https://github.com/lista-dao/lista-skills). Generated by `dapp-connect-agenticwallet` v1.8 (v0.3.0 — full 12-tool feature parity).
+
+Differences from upstream:
+- Signing path: `lista-wallet-connect` (WalletConnect) → `onchainos wallet contract-call` (TEE-based)
+- Output contract: each transaction tool now returns `pending_sign` instead of side-effecting tx submission
+- Read-only tools (`vaults`, `markets`, `holdings`) are unchanged and pass through
+- Original `lista-wallet-connect` skill is no longer required for signing