The Trench

Call The Trench Solana program on devnet using the public IDL and TS types.

This skill looks like a thin wrapper for calling a public devnet Solana program, but the package is incomplete: it references idl.json and TypeScript types that are not included and uses AnchorProvider.env() without declaring how a wallet/keypair will be provided. Before installing or using it: (1) Inspect the referenced homepage repository to confirm the IDL/types are public and unchanged, or provide those files yourself; (2) Do not paste private key material or seed phrases into the agent/chat — instead use a controlled wallet file or signer and confirm which env var/path the skill expects; (3) Ask the skill author to explicitly declare required environment variables and to bundle or fetch the IDL from a known URL (GitHub release) rather than relying on relative paths; (4) If the agent will be allowed to access your filesystem, be cautious: the SKILL.md's relative paths could cause it to read files outside the skill. These mismatches are not definitive evidence of malice, but they are enough reason to pause and require clarification or fixes before trusting the skill with keys or local files.

Type: OpenClaw Skill Name: the-trench Version: 0.1.0 The skill bundle is benign. It provides instructions and example TypeScript code for interacting with a Solana program on devnet. File access instructions (`{baseDir}/../idl.json`, `{baseDir}/../the_trench.ts`) and environment variable usage (`AnchorProvider.env()`) are standard for Solana development and are contextual to the stated purpose. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts to subvert the agent's behavior beyond its stated function. The network endpoint `https://api.devnet.solana.com` is a public devnet RPC.