Solpaw Interaction Skill

Launch Solana tokens on Pump.fun via the SolPaw platform. 0.1 SOL one-time fee. Your wallet is the onchain creator.

Before installing, consider the following: - Do not store your main Solana private key in an environment variable for a third-party skill. Prefer a dedicated wallet with minimal funds or an offline/hardware signing flow. - Verify whether the skill will perform local signing (/tokens/launch-local) or server signing (/tokens/launch). The code provided posts to /tokens/launch (server-side signing) which contradicts the docs that promise your wallet as the on-chain creator. Ask the author to confirm and/or change the code to use the local signing endpoint. - If you must test, create a throwaway wallet with <=0.15 SOL and test the flow first; never give this skill access to high-value keys. - Limit autonomous invocation: disable autonomous invocation for this skill or remove SOLANA_PRIVATE_KEY from the agent environment so it cannot sign without explicit manual steps. - Audit the upstream repository (github links are provided) and confirm the API endpoint and platform wallet are legitimate and match what is documented. Confirm CSRF/payment verification behavior on the server side. - If you need a safer setup: perform the signing step entirely offline (sign transaction locally), then manually submit the signed transaction via curl, keeping the skill's API key separate. Given the contradictions in docs vs code and the sensitive env var required, proceed only after clarifying the signing model and using a low-value test wallet.

Type: OpenClaw Skill Name: solpaw-skill-v2 Version: 0.1.1 The skill is classified as suspicious due to its explicit requirement for the `SOLANA_PRIVATE_KEY` environment variable, which the OpenClaw agent is instructed to use for local transaction signing. While the skill's design emphasizes local signing (preventing direct server-side exposure of the key), exposing a private key to an AI agent environment, as detailed in `SKILL.md`, `skill.json`, and `README.md`, represents a significant security risk. There is no clear evidence of intentional malicious behavior like exfiltration by the skill itself, but the inherent risk of handling such a sensitive credential by an autonomous agent warrants a 'suspicious' classification. All network communication is directed to `https://api.solpaw.fun`.