Torch Domain Auction Bot

Domain lending protocol on Solana. Domains become tokens. Tokens become collateral. Top holder controls the domain. Borrow SOL against your position -- but g...

This package appears internally consistent for operating a Solana 'keeper' that discovers tokens, scores underwater loans, and executes vault‑routed liquidations. Before installing or running it: 1) Verify the VAULT_CREATOR value points to the correct Vault on‑chain and that you understand which wallets are linked and authorized to use that Vault; a misconfigured Vault or an incorrectly linked agent could enable unintended economic actions. 2) Prefer the default ephemeral keypair (do not set SOLANA_PRIVATE_KEY) unless you deliberately want a persistent controller key—treat any private key as high‑sensitivity. 3) Review the included source (lib/kit and lib/torchsdk) yourself or have a trusted reviewer confirm the build: the kit includes on‑chain transaction builders that will sign and send transactions when run. 4) Confirm you trust the on‑chain program ID and website references in the manifest, and consider running the bot first on a testnet/fork to observe behavior with no real funds. 5) Keep the skill's disable-model-invocation:true setting if you do not want autonomous runs; changing that would materially increase risk.

Type: OpenClaw Skill Name: torchdomainauctionbot Version: 2.0.1 The OpenClaw AgentSkills bundle for Torch Domain Auction Bot is classified as benign. The skill demonstrates strong security practices, including the use of ephemeral, in-process keypairs by default (or securely loading an optional private key from environment variables without logging or transmitting it). All significant economic actions, such as liquidations and token launches, are routed through a user-controlled Torch Vault, ensuring the agent itself never holds substantial funds. The `SKILL.md` explicitly sets `disable-model-invocation: true`, preventing autonomous execution and mitigating prompt injection risks. External API calls are read-only and for legitimate purposes (e.g., CoinGecko for price data, SAID Protocol for wallet reputation, ExpiredDomains.net for domain discovery), and no sensitive data is transmitted to these endpoints. Dependencies are minimal, pinned to exact versions, and the SDK source is bundled for full auditability, with no evidence of malicious execution or persistence mechanisms.