solana-payments-wallet-dev

For stablecoin payment flows and wallet integrations on Solana 200x cheaper token accounts. Receive, send, balance, history, and client-side signing with Pri...

This skill is internally consistent for building Solana light-token payment and wallet integrations. Before installing: 1) provide a HELIUS_RPC_URL (it often contains an API key) and treat it as a secret; 2) only supply Privy credentials if you plan to use the Privy signing examples — these are sensitive and are sent to Privy's API (review sign-with-privy.md and verify endpoints); 3) cargo is only required for Rust nullifier examples — you can skip Rust-related steps if you only use the TypeScript examples; 4) the skill may request spawning scoped read-only subagents for research — confirm you’re comfortable with those limited reads; and 5) review the referenced example repositories and Privy integration docs before running any signing or transaction-sending code. If you want lower risk, avoid supplying Privy secrets and avoid spawning subagents that access external documentation automatically.

Type: OpenClaw Skill Name: solana-payments-wallet-dev Version: 1.0.2 The skill is classified as suspicious due to its explicit handling and transmission of highly sensitive secrets (`PRIVY_APP_SECRET`, `TREASURY_AUTHORIZATION_KEY`) to an external API (Privy) as detailed in `SKILL.md` and `references/sign-with-privy.md`. While the skill transparently warns about this behavior, the code examples in `references/sign-with-privy.md` instruct the agent to load these secrets from `process.env`, which contradicts the `SKILL.md`'s advice to use a secrets manager. This creates a significant vulnerability where an AI agent, if compromised or misdirected by prompt injection, could misuse or exfiltrate these critical credentials, even if the skill's stated purpose is legitimate.