← Back to Skills Marketplace
2210
Downloads
4
Stars
3
Active Installs
2
Versions
Install in OpenClaw
/install pump-fun
Description
Buy, sell, and launch tokens on Pump.fun using the PumpPortal API
Usage Guidance
This skill needs your Solana private key to operate. Before installing or using it: (1) do not export your main wallet key — use a dedicated, funded-with-minimal-SOL wallet or a signing-only/hardware wallet; (2) ask the publisher for source code or a package manifest (package.json) and a clear install spec — the SKILL.md's `npm install` instruction is inconsistent with the package containing no code; (3) verify the PumpPortal API endpoints and confirm where transactions are signed and whether any network requests might transmit your key; (4) prefer solutions that use an external signer (wallet adapter, hardware wallet, or walletconnect) rather than supplying a raw private key in an environment variable; (5) if you proceed, test with trivial amounts first and monitor transactions from the wallet. If the publisher cannot provide code, a reproducible install, and clear assurance that the private key is never transmitted off your device, treat the skill as unsafe to use.
Capability Analysis
Type: OpenClaw Skill
Name:
Developer:
Version:
Description: OpenClaw Agent Skill
The skill's purpose is to facilitate crypto trading on Pump.fun, which inherently requires access to a `SOLANA_PRIVATE_KEY`. This requirement is explicitly declared in `SKILL.md` as a necessary environment variable for the skill's stated functionality. The documentation also includes security notes, such as using a dedicated wallet and claiming 'Local Transaction API for maximum security', indicating an awareness of the sensitive nature of the operation. There is no evidence of intentional data exfiltration, malicious execution, persistence mechanisms, prompt injection attempts to subvert the agent, or obfuscation within the provided files. The `npm install` instruction is a standard setup step for Node.js projects and does not, by itself, indicate malicious intent.
Capability Assessment
Purpose & Capability
The skill's purpose (buy/sell/launch tokens on Pump.fun) legitimately requires access to a Solana private key, which the SKILL.md declares (SOLANA_PRIVATE_KEY). However the top-level registry 'Requirements' section lists no required env vars while the SKILL.md metadata requires SOLANA_PRIVATE_KEY — an inconsistency that needs clarification.
Instruction Scope
The SKILL.md instructs the agent to use a private key from SOLANA_PRIVATE_KEY and claims transactions are signed locally (expected for this purpose), but it also tells the user to run `cd {baseDir}` and `npm install` even though this skill is instruction-only and there are no code files or package manifest included. The instructions give broad discretion about RPC endpoint and local signing without showing where code runs, which is ambiguous and risky for a key-bearing workflow.
Install Mechanism
There is no install spec and no code files, yet the SKILL.md tells the user to run `npm install` in a baseDir. That discrepancy is suspicious: either required code is missing from the package, or the instructions expect downloading/running external code at runtime (not documented). Both situations increase risk because you don't know what would be installed or executed.
Credentials
Requiring a single sensitive secret (SOLANA_PRIVATE_KEY) is proportionate to trading on Solana, but exposing that key to an agent or putting it in an environment variable is high risk. The registry metadata omission of this required env var is inconsistent and makes it unclear whether the platform will prompt for or protect the key. No additional unrelated credentials are requested.
Persistence & Privilege
The skill is not always-enabled and does not request elevated or persistent platform privileges. Autonomous invocation is allowed by default but is not, by itself, an additional risk here — the main concern is what happens when the skill is invoked and given a private key.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install pump-fun - After installation, invoke the skill by name or use
/pump-fun - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.1
- Removed all source code and supplementary files; only documentation (SKILL.md) remains.
- No functional skill code is included in this version.
- Documentation is unchanged except for file removals in the package.
v1.0.0
Initial release of pump-fun trading skill.
- Enables buying, selling, and launching tokens on Pump.fun via the PumpPortal API.
- Provides commands for token trading: /pump-buy, /pump-sell, and /pump-launch.
- Supports pool selection, slippage and priority fee configuration.
- Requires SOLANA_PRIVATE_KEY environment variable for secure operation.
- Includes setup, security, and fee guidance.
Metadata
Frequently Asked Questions
What is Pump Fun?
Buy, sell, and launch tokens on Pump.fun using the PumpPortal API. It is an AI Agent Skill for Claude Code / OpenClaw, with 2210 downloads so far.
How do I install Pump Fun?
Run "/install pump-fun" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Pump Fun free?
Yes, Pump Fun is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Pump Fun support?
Pump Fun is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Pump Fun?
It is built and maintained by Playda (@playdadev); the current version is v1.0.1.
More Skills