Solpaw-Launcher

Launch Solana tokens on Pump.fun via the SolPaw platform. 0.1 SOL one-time fee. Your wallet is the onchain creator.

Do not install or give secrets until the implementation mismatch is resolved. The two red flags: (1) the docs promise local (client) transaction signing but the included SDK code calls the server-side /tokens/launch endpoint (which may make the platform the onchain creator), and (2) the skill declares SOLANA_PRIVATE_KEY required even though the code doesn't use it. Before using: 1) Ask the author which endpoint the SDK will call in production and whether the skill actually performs local signing or server signing. 2) If you plan to proceed, NEVER use your main wallet private key — create an ephemeral wallet with only ~0.15 SOL. 3) Prefer code that uses /tokens/launch-local + /tokens/submit (or review and modify the SDK to implement local signing). 4) Verify the API base URL (https://api.solpaw.fun) and the platform wallet on an independent source (official docs, repo). 5) Test on devnet or with a small amount before committing larger funds. If the author confirms the SDK will be changed to local signing or removes the private-key env requirement, re-evaluate — that would reduce concern.

Type: OpenClaw Skill Name: solpaw-launcher Version: 3.0.2 The skill is classified as suspicious due to a significant functional discrepancy between the advertised security model and the implemented SDK behavior. While `SKILL.md` and `README.md` strongly emphasize 'Local Mode' where the agent's wallet is the on-chain creator and `SOLANA_PRIVATE_KEY` is used for local signing only, the `solpaw-skill.ts` SDK's `launchToken` method uses the `/tokens/launch` API endpoint, which is described in `references/api-docs.md` as a 'Fallback' where the server signs the transaction and the platform wallet becomes the on-chain creator. This misrepresentation of token ownership and transaction signing mechanism, despite the `SOLANA_PRIVATE_KEY` not being exfiltrated, creates a trust vulnerability.