XRPL Token Sniping

Monitor XRPL for new token launches, verify issuer flags for safety, and execute fast token buys while managing XRP reserves to minimize risk.

This skill is coherent in intent (monitor XRPL and buy new tokens) but contains unclear and inconsistent instructions that raise safety concerns. Before using it you should: (1) verify the identity and reputation of the endpoints (xlrps-1.xrpl.link, xrplcluster.com) — do not use unknown hosts for private-key operations; (2) require the author to explicitly state dependencies and an install procedure (e.g., npm install xrpl) and provide secure key-handling instructions (use a vault, never paste private keys into chat or plain files); (3) ask the author to fix inconsistent flag logic and XRPL terminology and to explain how transaction signing and submitting is done securely; (4) test any code in a sandbox or on testnet with a throwaway wallet and minimal funds first; and (5) prefer skills that publish source, a homepage, and a verifiable owner identity. If you cannot confirm endpoints and private-key handling, do not run it with real funds.

Type: OpenClaw Skill Name: xrpl-token-snipe Version: 1.0.0 The skill is classified as suspicious due to its inherent high-risk nature, requiring direct access to a user's cryptocurrency wallet for submitting transactions on the XRPL network. While the `SKILL.md` provides safety instructions and connects to legitimate XRPL endpoints, it clearly demonstrates the prompt injection attack surface by issuing direct commands and decision-making guidance to the AI agent (e.g., 'SKIP if:', 'MUST VERIFY:'). This capability, even if used for benign purposes in this instance, represents a significant vulnerability that could be exploited if the skill were modified or if malicious instructions were injected.