Outsmart LP Farming

Manage LP positions on Solana DEXes to earn swap fees. Use when: user asks about LP farming, providing liquidity, earning yield, compounding fees, DLMM, DAMM...

This skill appears to do what it says, but you should take precautions before installing: 1) Verify the npm package and the linked GitHub repo (maintainer, recent commits, stars, issues) to ensure the CLI is legitimate. 2) Never put your primary long-term private key in an environment variable on shared hosts; prefer a wallet that can sign transactions (hardware wallet or dedicated signing service) or use an ephemeral key with limited funds. 3) Use a trusted RPC endpoint for MAINNET_ENDPOINT (or run your own) to avoid man-in-the-middle or front-running risks. 4) Audit the outsmart CLI code (or run it in a sandbox) before giving it signing credentials; npm packages can carry supply-chain risk. 5) Test commands on devnet/testnet first with small amounts. 6) If you need autonomous agent invocation, be aware the agent could run the CLI without interactive approval — keep credentials restricted. If any of these checks fail, treat the package as untrusted and do not provide your PRIVATE_KEY.

Type: OpenClaw Skill Name: outsmart-lp-farming Version: 1.0.0 The skill is classified as suspicious due to its direct requirement and implicit use of a `PRIVATE_KEY` environment variable for on-chain Solana transactions, which represents a high-risk capability. Additionally, it relies on installing an external `outsmart` CLI via `npm`, introducing a supply chain vulnerability where a compromised package could lead to malicious activity. While these capabilities are necessary for the stated purpose of managing LP positions, the direct handling of sensitive cryptographic material and reliance on external binaries without explicit malicious intent within the skill bundle itself warrants a 'suspicious' classification rather than 'benign' or 'malicious'.