Outsmart Devving Coins

Launch tokens on Solana launchpads. Use when: user asks about creating a token, devving a coin, launching a meme, PumpFun, LaunchLab, Jupiter Studio, DBC, bo...

This skill appears to be what it claims — a CLI-driven helper to create Solana tokens — but it will need your PRIVATE_KEY (wallet key) and will install an npm CLI. Before installing or using it: (1) verify the npm package and GitHub repository authorship and review the package contents or lock to a specific vetted version; (2) avoid supplying a mainnet wallet private key you care about — use a dedicated, funded test or limited-authority key, or a hardware/transaction-approval flow if possible; (3) consider running the npm install in a sandbox/container; (4) if you must use an env var for a key, prefer ephemeral keys or a signer that can restrict operations. If any of these controls cannot be met, do not install or provide your mainnet PRIVATE_KEY.

Type: OpenClaw Skill Name: outsmart-devving-coins Version: 1.0.0 The skill is suspicious due to its explicit requirement for the `PRIVATE_KEY` environment variable, which is highly sensitive, and its reliance on installing and executing an external `outsmart` CLI tool via npm (as seen in `SKILL.md`). While these actions are necessary for its stated purpose of launching tokens on Solana, they introduce significant supply chain and operational risks. The skill itself does not contain direct malicious code or prompt injection attempts for unauthorized actions, but it enables high-risk operations where a compromised `outsmart` tool could lead to credential theft or fund loss.