Skills lifi-stablecoin-swap
📦
lifi-stablecoin-swap
Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Build 1:1 LI.FI Stablecoin Swaps
Stablecoin transfers often expose users to gas, spreads, and uncertain output amounts. This skill guides Claude, Codex, and Claude Code through a LI.FI Intents integration for 1:1 swaps.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "lifi-stablecoin-swap" from https://skillstore.io/skills/internet-court-lifi-stablecoin-swap.md and its manifest at https://skillstore.io/api/skills/internet-court-lifi-stablecoin-swap/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "lifi-stablecoin-swap". Explain what happens after a user clicks swap.
Expected outcome:
The assistant describes approval, escrow order opening, solver delivery, settlement, expiry handling, and block explorer verification.
Using "lifi-stablecoin-swap". Adapt the quickstart for a production frontend.
Expected outcome:
- A concise implementation plan for token selection, wallet connection, quote loading, approval checks, and status polling.
- A review checklist covering integrator setup, contract addresses, supported routes, and user signing prompts.
Using "lifi-stablecoin-swap". Plan a REST integration for a non-TypeScript backend.
Expected outcome:
The assistant outlines quote request fields, EIP-7930 address handling, order construction, status polling, and error states.
Security Audit
High Riskv2 • 7/19/2026 Open versioned report
Most command, filesystem, and reconnaissance detections are false positives caused by Markdown and TypeScript syntax. The quickstart exposes an integrator credential and performs wallet writes without validating the connected chain. It also hides transaction costs and uses unpinned package installation commands.
2
Files scanned
526
Lines analyzed
8
Review items
0
False positives ignored
Confirmed security concerns (4)
High
Environment file access
const KEY = process.env.NEXT_PUBLIC_LIFI_INTEGRATOR_KEY!;
NEXT_PUBLIC_LIFI_INTEGRATOR_KEY is consumed by client-side code, making the integrator credential visible in the browser bundle. That exposure can enable unauthorized use of the integrator account.
High
Connected Chain Is Not Validated Before Wallet Writes
The Base allowance check is followed by wallet writes using wallet.chain without asserting Base. A different connected chain can target unintended same-address contracts.
The code fixes the read client and token constants to Base but passes the current wallet chain into both transaction writes. No chain assertion or switch appears before approval or order opening.
High
Financial Costs and Settlement Mechanics Are Hidden
The guidance says to keep gas, spreads, and solver mechanics off screen and show no fee field. The same flow requires approval and escrow transactions.
The concealment instruction is explicit, while the documented flow includes signed on-chain transactions that can incur source-chain gas and settlement risk.
Medium
Quickstart Installs Unpinned Packages
The quickstart runs create-next-app at the latest version and installs dependencies without exact versions. Future package changes can alter generated behavior or introduce supply-chain risk.
The commands explicitly use the latest scaffold and omit dependency versions. Reproducing the guide later can therefore resolve different code.
Capability review items (8)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Environment variable access (dot notation)
const KEY = process.env.NEXT_PUBLIC_LIFI_INTEGRATOR_KEY!;
The client quickstart reads NEXT_PUBLIC_LIFI_INTEGRATOR_KEY, which is embedded in the browser bundle. This exposes the integrator credential to every application user.
High
Environment variable object
const KEY = process.env.NEXT_PUBLIC_LIFI_INTEGRATOR_KEY!;
The client quickstart reads NEXT_PUBLIC_LIFI_INTEGRATOR_KEY, which is embedded in the browser bundle. This exposes the integrator credential to every application user.
Low
Fetch API call
const res = await fetch(
This code or instruction contacts the external order.li.fi status service with an order identifier. The request is expected functionality, but it is real network access.
Low
Hardcoded URL
`https://order.li.fi/orders/status?onChainOrderId=${orderId}`,
This code or instruction contacts the external order.li.fi status service with an order identifier. The request is expected functionality, but it is real network access.
Low
Fetch API call
const status = await fetch(
This code or instruction contacts the external order.li.fi status service with an order identifier. The request is expected functionality, but it is real network access.
Low
Hardcoded URL
Poll `GET https://order.li.fi/orders/status?onChainOrderId=<orderId>`:
This code or instruction contacts the external order.li.fi status service with an order identifier. The request is expected functionality, but it is real network access.
Low
Hardcoded URL
`https://order.li.fi/orders/status?onChainOrderId=${orderId}`,
This code or instruction contacts the external order.li.fi status service with an order identifier. The request is expected functionality, but it is real network access.
Low
Hardcoded URL
**Quote** — `POST https://order.li.fi/quote/request` (under your integrator key):
This instruction sends quote requests to the external order.li.fi service under an integrator identity. The request is expected functionality, but it is real network access.
Risk Factors
⚙️ External commands (50)
references/quickstart.md:125-133 references/quickstart.md:133-149 references/quickstart.md:149-170 references/quickstart.md:170 references/quickstart.md:185-189 SKILL.md:24 SKILL.md:46 SKILL.md:48-53 SKILL.md:53-55 SKILL.md:55-57 SKILL.md:57-63 SKILL.md:63-65 SKILL.md:65-67 SKILL.md:67 SKILL.md:70 SKILL.md:71 SKILL.md:77 SKILL.md:78 SKILL.md:81-98 SKILL.md:98-104 SKILL.md:104-105 SKILL.md:105-106 SKILL.md:106-108 SKILL.md:108-117 SKILL.md:117-126 SKILL.md:126-141 SKILL.md:141-142 SKILL.md:142 SKILL.md:147-153 SKILL.md:153-155 SKILL.md:155-157 SKILL.md:157-160 SKILL.md:160-164 SKILL.md:164-165 SKILL.md:165-166 SKILL.md:166-167 SKILL.md:167-179 SKILL.md:179-181 SKILL.md:181-183 SKILL.md:183-187 SKILL.md:187 SKILL.md:188-194 SKILL.md:194-195 SKILL.md:195 SKILL.md:196 SKILL.md:197-198 SKILL.md:198 SKILL.md:201-203 SKILL.md:203-214 SKILL.md:214-216
🌐 Network access (13)
📁 Filesystem access (3)
🔑 Env variables (4)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/internet-court-lifi-stablecoin-swap/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/internet-court-lifi-stablecoin-swap?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/internet-court-lifi-stablecoin-swap?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/internet-court-lifi-stablecoin-swap/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/internet-court-lifi-stablecoin-swap.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
internet-court. (2026). lifi-stablecoin-swap security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/internet-court-lifi-stablecoin-swap/audits/2BibTeX citation
@techreport{internet-court-internet-court-lifi-stablecoin-swap-2026,
author = {internet-court},
title = {lifi-stablecoin-swap security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/internet-court-lifi-stablecoin-swap/audits/2},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "lifi-stablecoin-swap security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
- name: "internet-court"
date-released: "2026-07-19"
url: "https://skillstore.io/skills/internet-court-lifi-stablecoin-swap/audits/2"
identifiers:
- type: other
value: "skillstore:internet-court-lifi-stablecoin-swap:audit:2"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 41
Architecture
85
Maintainability
87
Content
65
Community
83
Spec Compliance
What You Can Build
Add stablecoin transfers to a fintech app
Guide an engineering team through a 1:1 USDC or USDT transfer flow with on-chain verification.
Prototype a cross-chain swap interface
Create a Next.js wallet interface that quotes, approves, opens, and tracks a LI.FI Intents order.
Plan a backend integration path
Use the REST flow to design language-neutral quoting and order tracking for stablecoin payments.
Try These Prompts
Explain the swap flow
Use the lifi-stablecoin-swap skill to explain the LI.FI Intents 1:1 stablecoin swap flow in plain language.
Create a quickstart app
Use the lifi-stablecoin-swap skill to build a Next.js page that quotes, approves, opens, and tracks a USDC swap.
Adapt routes and tokens
Use the lifi-stablecoin-swap skill to adapt the example for my source chain, destination chain, token list, and amount input.
Design a REST backend
Use the lifi-stablecoin-swap skill to design a backend service that quotes LI.FI Intents orders and tracks settlement status.
Best Practices
- Confirm LI.FI has enabled 1:1 quoting for the integrator before testing user flows.
- Query supported chains and routes instead of hardcoding availability in production.
- Show users clear signing steps and verifiable transaction links after submission.
Avoid
- Do not promise 1:1 quotes before confirming account provisioning and route support.
- Do not hide wallet approvals or contract interactions from the user.
- Do not reuse sample token addresses without checking the intended chain and asset.
Frequently Asked Questions
What does this skill help build?
It helps build a 1:1 stablecoin swap using LI.FI Intents, the TypeScript SDK, or REST endpoints.
Does it support cross-chain swaps?
Yes. The examples cover cross-chain USDC movement, but live support depends on LI.FI route availability.
Do I need a LI.FI integrator account?
Yes. The 1:1 quote behavior requires an onboarded integrator with the feature enabled.
Can Claude Code or Codex use this skill?
Yes. The skill is structured for Claude, Codex, and Claude Code workflows.
Does the skill execute swaps by itself?
No. It provides implementation guidance. Users still review code and sign wallet transactions.
Is this a complete compliance solution?
No. Teams must perform their own compliance, custody, wallet, and production security reviews.
Developer Details
Author
internet-courtLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/internet-court/internet-court-skill/tree/main/vendored/lifi/lifi-stablecoin-swapRef
3f6e026a3363e0954ede7bef0cfe88d4475de137
Maintenance freshness
7/18/2026
Usage
1 downloads · 0 views
File structure