Solana + Polymarket + X Wallet Agent

Manage Solana and Polygon wallets, run Polymarket weather arbitrage, post to X/Twitter, and execute Raydium swaps — all from natural language.

Before installing or providing secrets: - Review the full source yourself (repo URL is provided) or have someone audit it; this skill will be able to decrypt wallets if you provide MASTER_ENCRYPTION_PASSWORD_CRYPTO + MASTER_ENCRYPTED + MASTER_SALT. - Expect the skill to store state under a data directory (default ~/.raphael) — wallet records, cached API creds, and PID files — and to make network calls to Solana RPC, Polygon RPC, pumpportal.fun, clob.polymarket.com and X/Twitter APIs. - The SKILL.md makes some inaccurate claims: it says the CLI reads only certain env vars and points to ~/.openclaw/.env for credentials, but the code also reads optional envs (POLYGON_RPC_URL, RAPHAEL_DATA_DIR, etc.) and writes to ~/.raphael by default. Do not assume the skill is limited to only the listed variables. - Treat MASTER_ENCRYPTION_PASSWORD_CRYPTO as a high-value secret. If you proceed, use a dedicated low-value/test wallet first (dry-run mode) and avoid putting large funds under the managed wallets until you are satisfied. - Prefer running the skill in an isolated environment (separate user account or VM), and verify the npm dependencies and package.json if running npm install. - Use the skill's dry-run options and start with small tests: create a wallet, list balances, and run the scanner with --dry-run and minimal privileges before enabling live trading or auto-posting. If you want, I can point to specific files/lines to check (e.g., where stored files are written and where network requests are made) or summarize exactly what would happen when you create a wallet or start the scanner.

Type: OpenClaw Skill Name: solana-wallet Version: 1.1.2 The skill bundle is a legitimate and well-structured tool for managing Solana/EVM wallets and executing automated trading strategies on Polymarket and pump.fun. It implements a secure local encryption model in `src/crypto.ts` using AES-256-GCM and PBKDF2 to protect private keys, requiring a user-provided master password that is never stored on disk. All network interactions in files like `src/polymarketClob.ts`, `src/xClient.ts`, and `src/swap.ts` are directed to official API endpoints (Twitter, Polymarket, Raydium, and Open-Meteo). The background daemon logic in `bin/solana-wallet.ts` is a standard implementation for long-running scanners, and the `SKILL.md` documentation provides clear safety warnings and operational transparency without any signs of prompt injection or malicious intent.