Pumpfun Agent Integration

Generate customer-ready Telegram polling bots + an Express-style web server that integrate Pump.fun Tokenized Agent payments using @pump-fun/agent-payments-s...

What to consider before installing or using this skill: - Inconsistency: The registry lists no required env vars, but the template requires multiple secrets (treasury secret key, API/BILLING tokens, Telegram bot token, RPC URL). Expect to provide and securely store those before running. - Env-var mismatch: Files use different env names (server.cjs expects SOLANA_RPC_URL while server.js expects RPC_URL). Confirm and unify the .env.example and runtime env names when stamping the template. - Sensitive key handling: The template generates per-user deposit wallets and stores their private keys (base58) in a local SQLite DB. This is a potential secret-exfiltration / theft risk if deployed as-is. For production, avoid storing raw private keys, use custodial best-practices, hardware modules, or derive one-time addresses that do not require storing long-term secrets. - TREASURY_SECRET_KEY_BASE58: This secret is required for treasury operations; do not commit it to source control and store it securely (secrets manager or HSM). The SKILL.md's 'do not commit .env' is necessary but not sufficient guidance. - Audit dependencies and code: The package-lock.json includes many third-party packages. Review @pump-fun/agent-payments-sdk and other dependencies for trustworthiness and expected behavior before using funds. - Run in isolation: Test the stamped project in an isolated environment with testnet RPC and throwaway keys first. Verify the invoice validation flow and that no unintended network calls or logging of secret material occur. - Operational hardening: Add access controls around the API_TOKEN/BILLING_TOKEN, enable TLS, secure the SQLite DB file, rotate keys, and add audit logging. Consider not using the demo pattern of per-user secret storage for production. Given the above mismatches and sensitive behaviors, do not deploy this template to production without resolving env-name inconsistencies, implementing safer key custody, and performing a security review.

Type: OpenClaw Skill Name: pumpclaw-agent Version: 1.0.1 The skill bundle provides a Telegram bot scaffold that implements a custodial wallet system, generating and storing user Solana private keys in a local SQLite database (deposit_secret_b58) to automate payments. This implementation directly contradicts the safety instructions in SKILL.md, which explicitly state 'Never sign transactions on behalf of the user.' Additionally, the server configuration (server.cjs and server.js) requires a sensitive TREASURY_SECRET_KEY_BASE58 environment variable that is initialized but never actually utilized in the provided code logic. While these patterns are common in high-risk custodial bot designs, the discrepancy between documentation and implementation, combined with the unnecessary collection of sensitive keys, makes the bundle suspicious.