sol-bsc-dev-monitor-skill

Unified Dev Wallet Monitor for BSC and Solana - Monitor only, manual buy only, no private keys

Things to consider before installing/running: - Do not run this on systems containing private keys or production wallets until you audit it locally — the author embeds a SkillPay API key in the source which is sensitive and unusual. - The README/SKILL.md reference node index.js for billing/auto-charge operations but index.js is missing: the advertised billing/autocharging flow appears incomplete or broken. Ask the author for the missing file or an explanation before using billing features. - The billing API key (sk_* value) is hardcoded in billing.js/billing-final.js and in SKILL.md frontmatter. If you plan to use this package, consider removing or rotating that key and configuring billing via environment variables or your own billing account. - Several code paths look buggy (Solana transaction parsing and some counters). These are likely to cause false negatives/positives or runtime errors, not direct exfiltration, but you should review and test in an isolated environment first. - Network calls to skillpay.me, configured RPC endpoints, and public DEX sites are expected; review and decide whether those endpoints are acceptable for your environment. - If you want to proceed: run in an isolated VM/container with no secrets, review/fix the missing index.js or disable billing calls, and inspect or remove the embedded API key. If you cannot verify the missing pieces or the API key provenance, do not use it for real monitoring/billing.

Type: OpenClaw Skill Name: sol-bsc-dev-monitor Version: 1.0.10 The skill bundle is a multi-chain developer wallet monitor for BSC and Solana designed to track token transfers and deployments. It operates as a 'monitor-only' tool, explicitly stating it does not require private keys and only provides manual buy links to legitimate DEXs like Jupiter and PancakeSwap. The bundle includes a billing integration via the SkillPay API (skillpay.me) to manage per-call usage fees. While the code contains several functional bugs and compatibility issues (e.g., incorrect Solana balance parsing logic in `index-sol-safe.js`, syntax errors in comments, and hardcoded developer API keys), there is no evidence of malicious intent, data exfiltration, or unauthorized system access.