← Back to Skills Marketplace
Project 0 - DeFi Native Prime Broker
by
Borcherd van Brakell
· GitHub ↗
· v2.2.6
407
Downloads
1
Stars
0
Active Installs
6
Versions
Install in OpenClaw
/install project-0
Description
Permissionless DeFi yield and credit on Solana via the Project 0 (P0) protocol. Deposit funds to earn yield across Solana's highest-yielding venues. Borrow s...
Usage Guidance
This skill is broadly coherent for a Solana on-chain broker, but it will ask for extremely sensitive items (your RPC endpoint and a private key file). Before installing or running it: (1) do not paste your main private key into chat — use a dedicated, low-value wallet or an external signer/hardware wallet; (2) confirm exactly which endpoints the agent will call (P0 API, wallet API, Jupiter) and that those are the official URLs; (3) ask the skill author to update requires.env to include the alternate env names it references (SOLANA_RPC_URL, HELIUS_RPC_URL, JUP_API_KEY) or explain why they aren't required; (4) prefer giving a view-only WALLET_ADDRESS for planning steps and only provide signing credentials interactively and after you review the exact transaction; (5) test with a very small amount first. If the author cannot explain the undeclared env names or insists on long-lived direct private-key access without external signing, treat it as higher risk.
Capability Analysis
Type: OpenClaw Skill
Name: project-0
Version: 2.2.6
The skill is classified as suspicious due to a prompt injection vulnerability and a supply chain risk. The 'Agent Workflow' instructions in SKILL.md explicitly tell the agent to 'use it directly' if 'the user provided a keypair path in their message'. This, combined with the `fs.readFileSync(keypairPath, 'utf-8')` in the 'Wallet setup' code, creates an arbitrary file read vulnerability where a malicious user could instruct the agent to read sensitive files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`). Additionally, the skill fetches and executes `VersionedTransaction` objects directly from the Jupiter API (`https://api.jup.ag/swap/v1/swap`) without explicit agent-side validation of the transaction's intent before signing, posing a supply chain risk if the Jupiter API were compromised.
Capability Assessment
Purpose & Capability
The name/description (permissionless DeFi on Solana) align with the requested items: an RPC URL, wallet keypair/address, P0 account, and a Jupiter API key for token swaps are all reasonable for an on-chain broker.
Instruction Scope
The SKILL.md describes sensible read-only and signing flows and instructs the agent to fetch wallet holdings, P0 data, and (optionally) perform swaps. However, the runtime instructions reference additional environment variables and lookup locations (SOLANA_RPC_URL, HELIUS_RPC_URL, JUP_API_KEY) that are not listed in requires.env — this is a minor inconsistency and should be clarified. The doc repeatedly emphasizes asking for confirmation before signing, which is appropriate.
Install Mechanism
Instruction-only skill with no install spec or code files. No packages or remote downloads are requested — low installation risk.
Credentials
The required env vars are plausible for the stated purpose, but they include highly sensitive items (WALLET_KEYPAIR meaning a private key file and RPC credentials). The SKILL.md also implicitly expects alternate names (SOLANA_RPC_URL, HELIUS_RPC_URL, JUP_API_KEY) that are not declared — a mismatch. Require-users-to-provide-private-keys behaviour is proportionate to on-chain signing, but elevates risk and should be limited (dedicated low-value wallet, hardware signing, or external signer).
Persistence & Privilege
always is false and there is no install step or modification of other skills/configs. The skill does not request permanent system presence beyond runtime environment variables.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install project-0 - After installation, invoke the skill by name or use
/project-0 - Provide required inputs per the skill's parameter spec and get structured output
Version History
v2.2.6
- Added security notice: explicitly require a dedicated wallet keypair for signing transactions; never use your main private key.
- Clarified that the agent will always ask for user confirmation before signing.
- Expanded supported environment variables for Solana RPC URLs and Jupiter API keys (now recognizes SOLANA_RPC_URL, HELIUS_RPC_URL, JUP_API_KEY).
- Updated credential collection steps to reflect new environment variable priorities and naming.
- Read-only operations now clearer: no keypair required.
- Minor clarifications throughout to improve safety and user guidance.
v2.2.5
**Changelog for version 2.2.5:**
- Added explicit requirements for `WALLET_ADDRESS`, `P0_ACCOUNT`, and `JUPITER_API_KEY` in environment metadata.
- Updated credential collection steps to clarify usage and checking of `RPC_URL`, `WALLET_KEYPAIR`, `WALLET_ADDRESS`, `P0_ACCOUNT`, and `JUPITER_API_KEY`.
- Refined instructions for swap credential handling—only `JUPITER_API_KEY` is mentioned now.
- No code or endpoint changes; documentation and environment setup guidance improved.
v2.2.4
project-0 v2.2.4 Changelog
- Updated required environment variables: `WALLET_KEYPAIR` is now listed as required alongside `RPC_URL` in metadata.
- No code or workflow changes; documentation and metadata only.
- Maintains same user and agent workflow as previous version.
v2.2.3
- Dropped unused environment variable requirements; only RPC_URL is now required in metadata.
- Version bump to 2.2.3 with no code or logic changes.
v2.2.2
Minor update to metadata requirements for environment variables.
- Added a metadata block specifying required environment variables: RPC_URL, WALLET_KEYPAIR, WALLET_ADDRESS, P0_ACCOUNT, JUPITER_API_KEY.
- Clarified primary environment variable as RPC_URL.
- No code or functional logic changes.
v1.0.0
Project 0 Skill v1.0.0 – Initial Release
- Introduced Project 0, a permissionless DeFi prime broker on Solana for unified yield and credit management.
- Supports wallet balance checks across SOL and supported tokens, with recommendations for best yield/credit actions.
- Provides step-by-step agent workflow for depositing, borrowing, swapping, and executing advanced yield strategies.
- Integrated with public APIs for fetching current lending pools and strategy data.
- Includes detailed user prompts for required credentials (RPC URL, wallet/keypair, and swap API key).
- Documentation and use-case examples supplied for streamlined onboarding.
Metadata
Frequently Asked Questions
What is Project 0 - DeFi Native Prime Broker?
Permissionless DeFi yield and credit on Solana via the Project 0 (P0) protocol. Deposit funds to earn yield across Solana's highest-yielding venues. Borrow s... It is an AI Agent Skill for Claude Code / OpenClaw, with 407 downloads so far.
How do I install Project 0 - DeFi Native Prime Broker?
Run "/install project-0" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Project 0 - DeFi Native Prime Broker free?
Yes, Project 0 - DeFi Native Prime Broker is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Project 0 - DeFi Native Prime Broker support?
Project 0 - DeFi Native Prime Broker is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Project 0 - DeFi Native Prime Broker?
It is built and maintained by Borcherd van Brakell (@borcherd); the current version is v2.2.6.
More Skills