← Back to Skills Marketplace
275
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install pmt-skill
Description
Predict pump.fun token graduations (YES/NO) on Solana mainnet via PumpMarket parimutuel betting markets.
Usage Guidance
This skill would legitimately need access to a Solana wallet to place bets, but the SKILL.md instructs the agent to read private keys from env vars or local files even though the registry metadata doesn't declare those secrets. Before installing: (1) Do not expose your main wallet private key—use a dedicated betting wallet funded with a small amount of SOL. (2) Verify ownership of the API/WebSocket host (pumpbet-mainnet.up.railway.app) and the homepage (pumpmarket.fun) — confirm they are official and review the posted IDL and program ID on-chain. (3) Prefer dry-run simulation and review the IDL/contract on Solana explorers to ensure the program behaves as claimed. (4) Confirm how Node dependencies will be installed and from which registries. (5) If you must provide a private key, use a short-lived or hardware-backed key and avoid storing it in plaintext environment variables or commits. If you want, provide the skill author/source or the exact IDL file URL and I can help verify the on-chain program and API endpoints further.
Capability Analysis
Type: OpenClaw Skill
Name: pmt-skill
Version: 1.0.0
The OpenClaw AgentSkills skill bundle for PumpMarket is benign. It provides comprehensive documentation and code examples for interacting with a Solana DeFi prediction market. The `SKILL.md` clearly outlines the purpose, API interactions, and on-chain transaction flows, including explicit warnings about using real SOL on mainnet and best practices for keypair security. The `pumpbets.json` IDL describes a standard Solana smart contract interface with no apparent malicious instructions. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, prompt injection against the agent, or obfuscation. The documentation even highlights a 'SECURITY FIX M3' in the smart contract, indicating a focus on security by the developers.
Capability Assessment
Purpose & Capability
The skill's stated purpose (betting on PumpMarket markets using a Solana wallet) is coherent with the actions described in SKILL.md (constructing transactions, signing, posting to an API). However the registry metadata lists no required environment variables or keyfile paths while the instructions explicitly show loading private keys from a KEYPAIR_PATH or PRIVATE_KEY env var and using npm packages. The absence of declared credential requirements and the metadata/instruction mismatch is a coherence issue.
Instruction Scope
SKILL.md instructs an agent to read local keyfiles or environment variables, sign messages with a wallet private key, post signatures and wallet activity to an external API (https://pumpbet-mainnet.up.railway.app), and submit on-chain transactions. Those steps are functionally necessary for an autonomous betting agent, but they broaden scope to sensitive local secrets and external network I/O not reflected in the declared requirements. Posting signatures and wallet identifiers to third-party endpoints is explicit in the instructions.
Install Mechanism
There is no install spec (instruction-only skill), which limits direct disk writes. SKILL.md and metadata reference npm packages (@coral-xyz/anchor, @solana/web3.js) but the registry's top-level requirements only list curl. That mismatch (metadata claiming npm deps but no install declared) is an engineering inconsistency rather than an immediate supply-chain red flag, but you should confirm how/where those Node dependencies will be installed and from which registries before running.
Credentials
The skill needs a wallet private key to place bets and sign the 'terms' acceptance, which is proportionate to its betting purpose. However the registry does not declare any required env vars or config paths while SKILL.md shows examples using environment variables (PRIVATE_KEY, KEYPAIR_PATH). Declaring sensitive env vars but not listing them in metadata is an incoherence. Also posting signed messages to an external service and running autonomous transactions increases the risk if a high-value wallet is used.
Persistence & Privilege
The skill does not request always: true and does not include install-time scripts; persistence/privacy footprint is limited to the runtime instructions the agent follows. However, because the skill enables on-chain actions that spend real SOL, granting it access to wallet private keys (even temporarily) would let it perform transactions autonomously — a high-impact capability if keys are mishandled. This is a behavioral risk rather than a metadata misconfiguration.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install pmt-skill - After installation, invoke the skill by name or use
/pmt-skill - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
PMT Skill allows any Claw Agent to trade on PumpMarket
x.com/pumpmarketfun
pumpmarket.fun
Metadata
Frequently Asked Questions
What is pumpmarket skill?
Predict pump.fun token graduations (YES/NO) on Solana mainnet via PumpMarket parimutuel betting markets. It is an AI Agent Skill for Claude Code / OpenClaw, with 275 downloads so far.
How do I install pumpmarket skill?
Run "/install pmt-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is pumpmarket skill free?
Yes, pumpmarket skill is completely free (open-source). You can download, install and use it at no cost.
Which platforms does pumpmarket skill support?
pumpmarket skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created pumpmarket skill?
It is built and maintained by King0 (@notking0); the current version is v1.0.0.
More Skills