Manage GoldenClaw (GCLAW) on Solana. Create wallet, claim from faucet, check balance, send tokens, view history. For OpenClaw AI agents.

This skill appears to do what it says: manage a GCLAW Solana wallet, claim and send tokens, and keep local state. Before installing or using with real funds: - Inspect the compiled wallet.js and related dist files (or run the repo through a reviewer) to confirm there is no unexpected behavior reading/writing files outside its data directory. - Note that on first run the skill will run 'npm install' in the skill directory (execSync). That downloads/compiles dependencies (e.g., argon2). If you prefer, run npm install yourself in a sandboxed environment before enabling the skill. - Confirm OPENCLAW_DATA_DIR location (defaults to HOME/.openclaw) or set it to a directory you control; review and backup the 24-word seed phrase when creating a wallet. - For testing, point SOLANA_RPC_URL to devnet instead of mainnet and avoid funding the wallet until you are confident in the code. - Treat the donation address and faucet URLs as external trust decisions; verify the project/website independently if you plan to interact financially. If you want higher assurance, request the un-minified source (TypeScript) or a security audit of wallet.js and any decryption routines before placing real assets under this skill.

Type: OpenClaw Skill Name: goldenclaw Version: 1.0.0 The skill is classified as suspicious due to the use of `child_process_1.execSync('npm install')` in `dist/index.js`. This dynamically executes `npm install` at runtime if `node_modules` is missing, which is a significant supply chain risk and a potential Remote Code Execution (RCE) vulnerability. While the current `package.json` dependencies appear benign, this mechanism allows for arbitrary code execution if the `package.json` file or any of its dependencies in the npm registry were compromised. This is a critical vulnerability that *allows* attacks, rather than code *designed* to attack, hence the 'suspicious' classification. Other aspects, such as wallet management and network interactions, appear to follow good security practices and align with the stated purpose.