Outsmart Trenching

Trade memecoins on Solana. Use when: user asks about memecoins, trenching, degen trading, ape, GMGN, Axiom, pump, 100x, alpha, CT, smart money, whale trackin...

This skill is coherent for trading on Solana, but it requires you to provide a PRIVATE_KEY environment variable and will run commands that can sign and broadcast transactions. Before installing: 1) Verify the npm package (author, version, GitHub repo, recent commits) and prefer installing from the official repository; 2) Do NOT supply your main wallet private key—use a funded burner wallet with limited funds; 3) Prefer an RPC endpoint you control or trust for MAINNET_ENDPOINT; 4) Review the 'outsmart' CLI source code (or run it in an isolated environment/container) to ensure it does not exfiltrate keys; 5) Consider using a hardware wallet or a signing service that avoids exporting private keys to env vars; 6) If you allow autonomous invocation, be aware the agent could execute trades without additional confirmations—disable autonomous invocation or require manual confirmations if you are risk-averse.

Type: OpenClaw Skill Name: outsmart-trenching Version: 1.0.0 The skill is classified as suspicious due to the inherent risks associated with its functionality and the execution model. It requires highly sensitive environment variables (`PRIVATE_KEY`, `MAINNET_ENDPOINT`) for financial transactions, and executes shell commands (`outsmart`, `curl`) with dynamic input (e.g., `MINT_ADDRESS`). While these actions are aligned with the stated purpose of memecoin trading, the reliance on dynamic input in shell commands introduces a significant shell injection vulnerability if the AI agent does not rigorously sanitize user-provided inputs before execution. There is no evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints, backdoors, or explicit prompt injection attempts to subvert the agent's directives within the provided files.