Token Launcher - Tator Launch Pad

Launch tokens on any chain without giving up 30-50% of your fees. Two paths: Easy Mode (call Tator API via x402 — works with any wallet provider, no env vars...

This skill appears to do what it says: Easy Mode calls a Tator API and needs no env vars; Direct Mode gives explicit SDK code that requires private keys, RPC URLs, and IPFS keys. Before using Direct Mode, ensure you: (1) never paste your primary wallet private key into an untrusted agent — create a dedicated launch wallet with minimal funds; (2) store keys in a secrets manager (not plaintext .env); (3) review any third‑party SDKs and contract addresses before deploying; (4) prefer Easy Mode if you want convenience and to avoid handling private keys yourself. If you plan to let an autonomous agent invoke this skill and you supply WALLET_PRIVATE_KEY or other secrets to the agent environment, treat that as a high-risk decision — only do so in tightly controlled infrastructure.

Type: OpenClaw Skill Name: tator-launch-pad Version: 1.0.3 The skill is classified as suspicious due to the direct access and usage of `WALLET_PRIVATE_KEY` (and `SOLANA_RPC_URL` for direct signing) in the code examples provided for 'Direct Mode' in `references/clanker.md`, `references/flaunch.md`, and `references/pumpfun.md`. While the skill's documentation (SKILL.md, REFERENCE.md) provides extensive and transparent warnings about the sensitive nature of these credentials and strongly advises secure storage (e.g., secrets managers, dedicated wallets, human-in-the-loop), the capability for an agent to directly access and use private keys from environment variables represents a high-risk vulnerability if the user's environment is not perfectly secured or if the agent is misused. There is no evidence of malicious intent such as data exfiltration, persistence, or unauthorized actions beyond the stated purpose of token launching and management; the prompt injection in SKILL.md is a benign safety mechanism.