Solana Connect

OpenClaw Solana Connect — Secure toolkit for AI agents to interact with Solana blockchain. Features private key protection, max limits, dry-run mode, and hum...

This package appears to implement Solana tooling but has several coherence and correctness issues you should address before use: - Key handling mismatch: generateWallet() returns only a public address, but sendSol() requires a base58 private key. The test suite incorrectly passes an address where a private key is expected — expect runtime failures if you follow tests verbatim. - Secret management ambiguity: README/ SKILL.md recommend using environment variables for private keys but the skill metadata does not declare a private-key env var; the code expects private keys as parameters. Decide on a secure secret flow (platform secret store, not plaintext env vars) and update docs and metadata. - Human confirmation & mainnet safety: the code enforces dry-run and thresholds, but warnings about mainnet are printed only; double-check enforcement logic before sending real funds (and never run on mainnet with real keys until audited). - Minor correctness issues: simulation code tries to reference transaction.signature (which may be undefined), and keypair/seed handling (fromSeed slicing) is brittle and may not match common wallet secret formats. These are bugs that could cause failed or malformed transactions. Recommendations: 1) Do not supply real private keys to this skill until the above are fixed and you understand how the key material is used. 2) Require the maintainer to fix the test/example usage and clarify how keys should be passed securely (prefer platform secret storage or explicit private-key env var declared in metadata). 3) Audit the signing and serialization logic (tweetnacl usage, signature attachment, simulation fields) before any mainnet use. 4) If you lack the ability to review/fix the code, treat this as untrusted and run only in isolated test environments (no real funds).

Type: OpenClaw Skill Name: solana-connect Version: 3.0.0 The OpenClaw Solana Connect skill bundle is designed with a strong emphasis on security, explicitly implementing features like private key protection (keys are never exposed to the agent, only used internally for signing), transaction limits, dry-run mode by default, and a human confirmation threshold for large transactions. All dependencies listed in `package.json` and `package-lock.json` are standard and legitimate for Solana development. The `SKILL.md` and `README.md` files provide clear, security-conscious instructions and documentation without any evidence of prompt injection or malicious intent. The `scripts/solana.js` code consistently enforces these security measures, making it a well-behaved and safe toolkit for AI agents to interact with the Solana blockchain.