Solana Copy Trader

Solana whale copy trading bot. Track any wallet, copy trades in real-time via Jupiter + Pump.fun APIs, with paper trading simulation and live execution. Use...

This package is an actual Solana trading bot and will contact multiple external services (Helius RPC, Jupiter, pump.fun, solanatracker, Coingecko, Telegram). The main red flags are: (1) the registry metadata claims no required env vars while both SKILL.md and the code require PRIVATE_KEY, HELIUS_API_KEY, BOT_TOKEN, CHAT_ID and RPC_URL — that mismatch is suspicious and should be fixed before trusting the package; (2) SKILL.md references a different directory (.env.example, solana-bot) than the manifest (files under scripts/), which suggests the published metadata or instructions were not updated — expect friction and possible runtime errors. Before installing or providing secrets: - Do NOT put your main wallet private key into .env. Use a small, dedicated wallet for testing or hardware/readonly setups. - Run the code in an isolated environment (container/VM) and inspect node_modules before running. - Start in watch or paper modes only (no PRIVATE_KEY or set paper:true). - Verify the Telegram bot and chat IDs are correct and optional. - Ask the publisher to correct registry metadata (declare required env vars and primary credential), include .env.example in the package root, and fix path inconsistencies. If the author can provide a trustworthy source URL, homepage, or VCS repo and update the metadata, re-evaluate; until then treat the package as suspicious.

Type: OpenClaw Skill Name: solana-copy-trader Version: 1.0.0 The skill bundle is classified as suspicious due to its core functionality involving automated cryptocurrency trading with real funds, which inherently carries high financial risk. While the code includes safeguards like defaulting to paper trading and explicit warnings to use a burner wallet for live execution, it requires the user to provide a Solana private key for real transactions. This capability, though necessary for its stated purpose, represents a significant risk of financial loss if misused or if vulnerabilities exist in the bot's trading logic. There is no evidence of intentional malicious behavior such as unauthorized data exfiltration, persistence mechanisms, or prompt injection attempts against the AI agent.