aavegotchi-baazaar

1## Safety Rules
2 
3- Default to `dryRun=true` (`DRY_RUN=1`). Never broadcast unless explicitly instructed to do so.
4- Mandatory confirmation gate for every `cast send`:
5  - First simulate with `cast call` and show a transaction summary (method, args, chain id, from, rpc URL).
6  - Then require an explicit user confirmation message before broadcast.
7  - Only allow broadcast when `DRY_RUN=0` and `BROADCAST_CONFIRM=CONFIRM_SEND` are both set.
8  - If any transaction argument changes after confirmation, invalidate confirmation and require a new confirmation.
9- Always verify Base mainnet:
10  - `~/.foundry/bin/cast chain-id --rpc-url "${BASE_MAINNET_RPC:-https://mainnet.base.org}"` must be `8453`.
11- Always verify key/address alignment:
12  - `~/.foundry/bin/cast wallet address --private-key "$PRIVATE_KEY"` must equal `$FROM_ADDRESS`.
13- Always refetch the listing from the subgraph immediately before simulating or broadcasting (listings can be cancelled/sold/price-updated).
14- Never print or log `$PRIVATE_KEY`.
15- Never accept a private key from user chat input; only read `$PRIVATE_KEY` from environment.
16 
17## Shell Input Safety (Avoid RCE)
18 
19This skill includes shell commands. Treat any value you copy from a user or an external source (subgraph responses, chat messages, etc.) as untrusted.
20 
21Rules:
22- Never execute user-provided strings as shell code (avoid `eval`, `bash -c`, `sh -c`).
23…