📦

lifi

Name: lifi
Author: internet-court

Content revision r1 High Risk 🌐 Network access⚙️ External commands🔑 Env variables

Build LI.FI Cross-Chain API Integrations

Cross-chain swap and DeFi integrations require many chain, token, status, and approval details. This skill gives Claude, Codex, and Claude Code concise LI.FI API guidance for quotes, routes, vaults, and intents.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "lifi" from https://skillstore.io/skills/internet-court-lifi.md and its manifest at https://skillstore.io/api/skills/internet-court-lifi/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/internet-court-lifi.md Signed manifest GET /api/skills/internet-court-lifi/manifest Signed lockfile GET /api/skills/internet-court-lifi/lockfile

Test it

Using "lifi". Bridge USDC from Arbitrum to Base with LI.FI.

Expected outcome:

Use a Core API quote with source and destination chain IDs.
Check the approval address and wait for any approval transaction.
Re-fetch the quote before signing if the first quote is stale.
Poll status until the transfer reaches a terminal state.

Using "lifi". Find depositable USDC vaults on Base.

Expected outcome:

Query Earn vaults with chain, asset, and Composer support filters.
Compare APY, TVL, caps, KYC, and withdrawal settings.
Use the selected vault address as the Composer destination token.

Using "lifi". Handle a partial bridge completion.

Expected outcome:

Confirm the received token and destination chain from status data.
Explain that value may be received in a different token.
Offer a same-chain recovery swap when gas costs are reasonable.

Security Audit

High Risk

v2 • 7/19/2026 Open versioned report

Of 147 static findings, 133 are false positives caused by Markdown formatting, placeholders, API terms, or non-executing endpoint references. Fourteen findings confirm intended outbound calls to LI.FI services, while two semantic findings identify high-risk transaction and vault-selection workflows. No prompt injection attempt was found.

Files scanned

1,472

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:44-67 SKILL.md:193-199

Asset-moving workflow lacks mandatory user confirmation

The skill directs agents to approve, sign, and send transactions without requiring explicit confirmation of chain, tokens, amount, recipient, spender, fees, and slippage.

The documented canonical flow explicitly says to approve, sign, and send transactionRequest. No mandatory pre-signing user confirmation or complete transaction review is specified.

High

SKILL.md:291-301

Yield example automatically selects the highest-APY vault

The Node.js example selects the first APY-sorted vault for a deposit quote without validating protocol risk, TVL, timelocks, caps, KYC, or user preference.

The example requests vaults sorted by APY and directly uses vaults[0].address as the deposit target. The shown code contains no risk filter or user selection step.

Capability review items (14)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low

references/REFERENCE.md:102

Hardcoded URL

curl "https://li.quest/v1/quote?\

This executable curl example sends a request to an external LI.FI service. The call is expected, but it discloses supplied query data and trusts a third-party response.

Low

references/REFERENCE.md:391

Hardcoded URL

curl "https://li.quest/v1/chains?chainTypes=EVM,SVM,UTXO,MVM,TVM"

This executable curl example sends a request to an external LI.FI service. The call is expected, but it discloses supplied query data and trusts a third-party response.

Low

references/REFERENCE.md:436

Hardcoded URL

curl "https://li.quest/v1/tokens?chains=1,8453&tags=stablecoin"

This executable curl example sends a request to an external LI.FI service. The call is expected, but it discloses supplied query data and trusts a third-party response.

Low

references/REFERENCE.md:658

Hardcoded URL

curl "https://li.quest/v1/quote?\

This executable curl example sends a request to an external LI.FI service. The call is expected, but it discloses supplied query data and trusts a third-party response.

Low

SKILL.md:275

Fetch API call

const res = await fetch(`${BASE_URL}/quote?${new URLSearchParams(params)}`);

The sample performs an outbound quote request to LI.FI with wallet and routing parameters. This intended call exposes transaction metadata to a third-party service.

Low

SKILL.md:283

Fetch API call

const data = await (await fetch(`${BASE_URL}/status?${params}`)).json();

The sample sends a transaction hash and routing context to LI.FI for status tracking. This is intended functionality, but it discloses transaction metadata externally.

Low

SKILL.md:292

Fetch API call

const { data: vaults } = await (await fetch(

The sample performs an outbound request to the LI.FI Earn service for vault data. It is read-only, but depends on untrusted third-party network data.

Low

SKILL.md:243

Python HTTP libraries

r = requests.get(f"{BASE_URL}/quote", params=params, headers=HEADERS)

The sample performs an outbound quote request to LI.FI with wallet and routing parameters. This intended call exposes transaction metadata to a third-party service.

Low

SKILL.md:250

Python HTTP libraries

return requests.get(f"{BASE_URL}/status", params=params, headers=HEADERS).json()

The sample sends a transaction hash and routing context to LI.FI for status tracking. This is intended functionality, but it discloses transaction metadata externally.

Low

SKILL.md:32

Hardcoded URL

curl "https://li.quest/v1/chains" -H "x-lifi-api-key: YOUR_API_KEY"

This executable curl example sends a request to an external LI.FI service. The call is expected, but it discloses supplied query data and trusts a third-party response.

Low

SKILL.md:57

Hardcoded URL

curl "https://li.quest/v1/quote?\

This executable curl example sends a request to an external LI.FI service. The call is expected, but it discloses supplied query data and trusts a third-party response.

Low

SKILL.md:64

Hardcoded URL

curl "https://li.quest/v1/status?txHash=0xYourTxHash&fromChain=42161&toChain=10&bridge=across"

This executable curl example sends a request to an external LI.FI service. The call is expected, but it discloses supplied query data and trusts a third-party response.

Low

SKILL.md:136

Hardcoded URL

curl "https://li.quest/v1/quote?\

This executable curl example sends a request to an external LI.FI service. The call is expected, but it discloses supplied query data and trusts a third-party response.

Low

SKILL.md:165

Hardcoded URL

curl "https://earn.li.fi/v1/vaults?chainId=8453&asset=USDC&sortBy=apy&isComposerSupported=true&limit

This executable curl example sends a request to an external LI.FI service. The call is expected, but it discloses supplied query data and trusts a third-party response.

Risk Factors

🌐 Network access (31)

⚙️ External commands (50)

🔑 Env variables (3)

SKILL.md:32 SKILL.md:166 SKILL.md:234

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/internet-court-lifi/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/internet-court-lifi/security.svg)](https://skillstore.io/skills/internet-court-lifi?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/internet-court-lifi?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-lifi/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/internet-court-lifi.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

internet-court. (2026). lifi security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/internet-court-lifi/audits/2

BibTeX citation

@techreport{internet-court-internet-court-lifi-2026,
  author = {internet-court},
  title = {lifi security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/internet-court-lifi/audits/2},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "lifi security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
  - name: "internet-court"
date-released: "2026-07-19"
url: "https://skillstore.io/skills/internet-court-lifi/audits/2"
identifiers:
  - type: other
    value: "skillstore:internet-court-lifi:audit:2"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Build swap and bridge flows

Plan LI.FI quote, approval, signing, and status steps for cross-chain token movement.

Evaluate DeFi vault integrations

Use Earn and Composer guidance to discover vaults and design deposit or withdrawal flows.

Design agent transaction workflows

Create guarded API workflows for route selection, intent orders, polling, and recovery handling.

Try These Prompts

Explain a bridge quote

Explain the LI.FI quote flow for bridging USDC from Arbitrum to Optimism. Include approval checks and status polling.

Draft swap parameters

Draft parameters for a same-chain swap from ETH to USDC on Polygon. Include slippage, route order, and stale quote handling.

Plan Earn discovery

Design an Earn discovery flow for Base USDC vaults. Include filters, data freshness, and Composer deposit steps.

Review an intents backend

Review my backend plan for LI.FI Intents. Flag signing, expiry, refund, and status tracking gaps.

Best Practices

Re-fetch quotes after approvals and before any signing step.
Use exact approvals and the quoted approval address for ERC-20 tokens.
Cache discovery endpoints and back off when rate limits are returned.

Avoid

Hardcoding spender addresses instead of using the quoted approval address.
Assuming a timeout means failure before checking status and explorer links.
Selecting vaults from APY alone without checking caps, locks, and KYC.

Frequently Asked Questions

Does this skill execute token swaps?

No. It explains LI.FI API flows and examples. Wallet signing and transaction submission remain separate user actions.

Do I need a LI.FI API key?

Core quote endpoints can work without a key. Earn endpoints and higher rate limits may require one.

Can it help with DeFi deposits?

Yes. It explains Composer routes that use vault or staking token addresses as destination tokens.

Does it cover non-EVM chains?

Yes. It notes chain type filters for EVM, Solana, Bitcoin, Sui, and Tron where supported.

How should failed routes be handled?

Use the documented status, substatus, retry, and recovery guidance before retrying or changing route parameters.

Is this financial advice?

No. It is technical API documentation. Users must evaluate financial risk before any transaction.

Developer Details

Author

internet-court

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/internet-court/internet-court-skill/tree/main/vendored/lifi/lifi

Ref

3f6e026a3363e0954ede7bef0cfe88d4475de137

Maintenance freshness

7/18/2026

Usage

1 downloads · 0 views

File structure

📁 references/

📄 REFERENCE.md

📄 SKILL.md