Solana

Solana wallet operations - create wallets, check balances, send SOL/tokens, swap via Jupiter, launch tokens on Pump.fun

This skill appears to do what it says, but it operates on your private key so treat it as high-risk: only install if you trust the code. Specific points to consider before installing: - SOLANA_PRIVATE_KEY gives full control of the wallet (can send funds). Use a throwaway wallet or one with minimal funds for testing. - initialize.py writes/overwrites a .env file in the current working directory; back up any existing .env first. - The SKILL.md suggests using 'solana-keygen grind' for vanity addresses but that binary is not declared — you must install it separately if you want that feature. - The skill will call external services: Jupiter API (requires JUPITER_API_KEY) and Solana RPC endpoints; network calls are expected for swaps and on-chain actions. - Review the pump.fun fee recipient and launch logic if you plan to use the token-launch feature — fees/recipients are hardcoded to Pump.fun program accounts. - Install Python dependencies in an isolated virtualenv and inspect the scripts locally before exporting your real private key into the environment. If you want, I can do a line-by-line review of any truncated sections of the scripts or help create a safe test procedure (devnet-only) and a guide to limit exposure (e.g., generate a new wallet, fund with minimal SOL, and test swaps on devnet).

Type: OpenClaw Skill Name: solana-skills Version: 0.1.2 This skill is classified as suspicious due to its inherent high-risk capabilities, specifically the handling of cryptocurrency private keys and the execution of irreversible financial transactions on the Solana blockchain (sending SOL/tokens, swapping, launching tokens). While these actions are aligned with the stated purpose of a 'Solana wallet operations' skill, they represent significant financial risk if misused or compromised. The `scripts/initialize.py` script creates and saves a `SOLANA_PRIVATE_KEY` to a local `.env` file, and `scripts/jup_swap.py`, `scripts/pumpfun.py`, and `scripts/wallet.py` all load and use this key to sign transactions. No evidence of intentional malicious behavior, data exfiltration to unauthorized endpoints, or prompt injection attempts in `SKILL.md` was found, but the nature of the operations warrants a 'suspicious' classification.