Solana Transfer

Send SOL or SPL tokens on the Solana blockchain from OpenClaw agents for payments, rewards, or on-chain transaction settlements.

This skill appears to do what it says (send SOL and SPL tokens). Before installing: 1) Review the index.js code yourself and test on devnet — do not use real funds until verified. 2) Be careful with keypair.json: treat it as a private key, store it securely, and avoid copying keys between machines carelessly. 3) The SKILL.md assumes the Solana CLI (solana-keygen) exists but the registry metadata doesn't declare it — ensure you have that tool or generate keypairs securely another way. 4) npm install will fetch packages from the public registry; run installs in a controlled environment and check package versions if you require stricter supply-chain guarantees. 5) If you don't want automatic transfers, restrict autonomous agent permissions or require human approval for any action that calls sendSOL/sendSPLToken. If you want more assurance, request the publisher to explicitly declare required binaries/env vars and provide a minimal security audit or reproducible build steps.

Type: OpenClaw Skill Name: solana-transfer Version: 0.1.0 The OpenClaw AgentSkills skill bundle for Solana transfers is benign. The `index.js` script correctly implements SOL and SPL token transfers using official Solana SDKs, loading its configuration and keypair from expected paths (`config.json`, `keypair.json`). There is no evidence of data exfiltration beyond its stated purpose (Solana transactions), malicious execution, persistence mechanisms, or obfuscation. The `SKILL.md` and `README.md` files provide clear, legitimate instructions for setup and usage, and do not contain any prompt injection attempts or hidden directives aimed at manipulating the AI agent for malicious purposes; in fact, they include good security advice regarding keypair management and transaction validation.