solana-skill

Interact with Solana blockchain via Helius APIs. Create/manage wallets, check balances (SOL + tokens), send transactions, swap tokens via Jupiter, and monitor addresses. Use for any Solana blockchain operation, crypto wallet management, token transfers, DeFi swaps, or portfolio tracking.

Key points to consider before installing or running this skill: - It requires a Helius API key stored in ~/.config/solana-skill/config.json, but the registry metadata does not declare this — you must create that file yourself or the skill will fail. Do not paste your key into a public place. - The wallet encryption uses a default password derived from environment values (USER + HOME hashed). That is predictable and weak: change the implementation to require a user-supplied passphrase or use a hardware/external signer before storing real funds. Do NOT rely on the default behavior if you care about secrecy. - The skill writes encrypted wallets and logs to ~/.config/solana-skill; ensure filesystem permissions are restricted and back up keys securely. Consider using external signing (hardware wallet) instead of importing private keys into this tool. - The references allow creating webhooks pointing at arbitrary endpoints; if you enable webhook functionality, only register endpoints you control and review what activity is being forwarded to avoid leaking address activity to third parties. - There are mentions of regional Helius sender endpoints over HTTP in the docs — verify the endpoints the code actually uses (the code uses getRpcUrl → HTTPS) and avoid using non-TLS endpoints. - Before trusting with substantial funds: (1) review and if needed modify getDefaultPassword to prompt for a passphrase; (2) run the code locally and inspect it; (3) test sending small amounts first; (4) consider running in an isolated environment. If you want, I can (a) point out the exact lines you should change to require a passphrase prompt, (b) produce a minimal checklist to safely run this skill, or (c) create a patched version that prompts for a user password instead of deriving one from env vars.

Type: OpenClaw Skill Name: solana-basics Version: 1.0.0 The skill bundle is classified as benign. All code and documentation align with the stated purpose of interacting with the Solana blockchain via Helius and Jupiter APIs. There is no evidence of intentional harmful behavior such as data exfiltration, malicious execution, persistence, or prompt injection against the agent. Sensitive data like private keys are encrypted at rest using a machine-derived key (as detailed in `scripts/wallet.ts` and `references/security.md`), and file permissions are set securely. All network calls are to legitimate Solana ecosystem endpoints (Helius RPC, Jupiter API) for core functionality.