Sur

Create and trade tokens on SURGE via API with server-managed wallets, one-time free funding, and auto-routed pre-DEX and post-DEX trading on EVM (Base) or So...

This skill will ask you to give it a SURGE API key and will then create and fund server-managed wallets and launch/trade tokens on your behalf. Before installing or handing over a key: - Be aware of the metadata mismatch: the registry entry shows no required credentials, but the instructions require a secret API key. Ask the publisher why the registry metadata omits the API key requirement. - Treat the API key as a secret. Prefer creating a dedicated, limited-scope test key for this skill, not your main account key. If possible, create a key you can revoke easily after testing. - Do not paste long-lived production keys into public or shared chats. If you must provide a key to the agent, use a temporary/test key and revoke it after use. - Understand custody implications: the SURGE backend (back.surgedevs.xyz) will manage wallets and private keys; you are trusting that service with funds. Verify the service identity (app.surgedevs.xyz), read their docs/privacy/security, and consider using only small/test amounts first. - Because the skill's publisher/source is unknown and there is no homepage, exercise extra caution: ask for publisher verification, check reviews or community references, and consider contacting SURGE directly to confirm the API endpoints and behavior before giving access. If you decide to proceed, create a minimal-scope test API key, use test funds only, monitor the key's activity, and revoke it when finished.

Type: OpenClaw Skill Name: sur-pub Version: 1.0.0 The OpenClaw skill bundle is designed to help users create and trade tokens on the SURGE platform (DEV environment) via API calls to `https://back.surgedevs.xyz`. The `SKILL.md` provides extensive instructions to the AI agent, including strong guardrails such as 'Never invent data,' 'Always confirm before launch,' and 'Translate errors,' which mitigate common AI agent risks. While the agent is instructed to tell the user to use `curl -F ... https://file.io` for file uploads, this is a common pattern for users to provide direct links, not an instruction for the agent to execute arbitrary commands. The 'do this silently' instruction is for a benign configuration fetch (`GET /openclaw/launch-info`). There is no evidence of intentional data exfiltration, backdoor installation, or unauthorized remote control, and all API interactions are confined to the stated purpose and domain.