Solpaw

Launch Solana tokens on Pump.fun via the SolPaw platform. 0.1 SOL one-time fee. Your wallet is the onchain creator.

Do not supply your Solana private key to this skill until the ownership/signing behavior is clarified. Specific actions to consider before installing or using: - Verify which API endpoint the code calls: /tokens/launch (server signs, platform becomes creator) vs /tokens/launch-local (client signs, you remain creator). The included TypeScript calls /tokens/launch — that contradicts the documentation's claim that your wallet will be the onchain creator. - Prefer local signing: if you want to remain the onchain creator, require the skill to use /tokens/launch-local or provide a signing-only helper that never sends your private key to the network or server. - Never place long-term private keys in shared environment variables on multi-user machines. Use ephemeral/local signing (hardware wallet, offline signing, or a process that reads a key from a secure keystore) where possible. - Confirm the platform wallet address and test with minimal-risk flows (use a devnet/testnet or a small-value account) before sending real funds. The 0.1 SOL payment is irreversible and could be lost or result in the platform controlling the token if the server signs. - If you plan to use this skill, request the maintainer update the SDK to clearly expose a payAndLaunch/local-signing method (and/or remove SOLANA_PRIVATE_KEY from required envs if unused), or patch the code to use /tokens/launch-local and local signing. If the maintainer cannot justify the private key requirement, treat it as unnecessary and risky.

Type: OpenClaw Skill Name: solpaw-skill Version: 0.1.0 The skill is suspicious due to a significant discrepancy between its stated functionality and its actual implementation. The `SKILL.md` and `README.md` explicitly claim that the agent's wallet will be the onchain creator and that local signing is used for token launches. However, the `solpaw-skill.ts` implementation calls the `/tokens/launch` API endpoint, which, according to `references/api-docs.md`, is a 'Lightning mode' where the 'server signs the transaction' and the 'Platform wallet is the onchain creator (not recommended)'. This misrepresentation of token ownership and signing mechanism, despite the skill requiring the sensitive `SOLANA_PRIVATE_KEY` environment variable, raises serious trust concerns about the skill's transparency and the true control over launched assets via `https://api.solpaw.fun`.