Pacifica

Trade perpetuals on Pacifica via 36 MCP tools. Market data, account monitoring, order execution, subaccounts, and real-time WebSocket streaming on Solana. Tr...

Do not install or run this skill until you confirm how it obtains and uses signing credentials. Ask the publisher: (1) Where does the code run and who controls it? (2) Exactly how are transactions signed—does the agent require your private key file (~/.pacifica-mcp/config.json) or an external wallet (Phantom/Backpack) for interactive signing? (3) If a private key file is created, is it encrypted and stored locally only? (4) Are there any network endpoints the skill will send your keys or trade data to? If you cannot get clear answers and inspect the implementation, avoid granting it access to funds or running it in autonomous mode. Prefer skills that require explicit, auditable credentials (hardware wallet, explicit API key) or that delegate signing to your browser wallet rather than storing private keys in agent-accessible files.

Type: OpenClaw Skill Name: pacifica Version: 1.0.0 The skill provides 36 tools for crypto trading on the Pacifica platform, including high-risk operations like 'pacifica-withdraw', 'pacifica-transfer-funds', and 'pacifica-market-order'. While these are aligned with the stated purpose of a trading agent, the instructions explicitly tell the AI to 'execute directly' for autonomous use, bypassing user confirmation for financial transactions. Furthermore, the skill manages sensitive private keys stored locally at '~/.pacifica-mcp/config.json', which is a high-value target for potential exploitation or exfiltration, although no explicit malicious code or exfiltration logic is present in the provided files.