Solana Trading Terminal — SoulPass

Solana trading and DeFi skill for AI agents with hardware-secured wallet. Swap tokens on Jupiter DEX, trade meme coins with rug-pull detection, earn yield vi...

This skill appears to implement a legitimate Solana CLI that uses Apple Secure Enclave, but there are two things to verify before installing or running it: 1) Source authenticity: only run the Homebrew tap or build commands if you can verify the soulpassai tap/GitHub repo and release signatures. Installing a CLI with sudo to /usr/local/bin gives a lot of power to that binary. 2) Daemon safety: the instructions tell you to run 'soulpass serve' which opens a JSON-RPC endpoint (127.0.0.1:8402) able to perform swaps, payments, and batch transfers. Confirm whether that daemon requires authentication, origin checks, or explicit interactive confirmations for signing. If it accepts unauthenticated local requests, any local process (or a compromised agent) could cause real fund transfers. Prefer one-off CLI commands unless you can ensure the daemon is locked down (bind to localhost only, enable auth tokens, require confirmation on each signed transaction, firewall rules) and you understand who/what can access it. Additional suggestions: restrict OS (use only on Apple devices with Secure Enclave as claimed), review the published source code or audit binary releases, avoid running the daemon as root, keep merchant config and diary files private, and require user confirmation for any payment or transfer initiated by an agent.

Type: OpenClaw Skill Name: soulpass Version: 1.0.0 The skill implements a Solana trading terminal and agent commerce framework that requires installing a third-party binary (soulpass) and running a background daemon (soulpass serve). It is classified as suspicious because it grants the agent autonomous control over financial assets and includes explicit instructions in references/diary-voice.md to monitor the owner's habits, language, and 'contradictions' to be logged in a 'public' diary. While these features are aligned with the stated 'SoulPass' social-trading ecosystem (soulpass.ai), the combination of binary installation, financial autonomy, and user surveillance represents a significant security and privacy risk surface.