← 返回 Skills 市场
Torch Liquidation Bot
作者
mr brightside
· GitHub ↗
· v10.7.1
· MIT-0
2666
总下载
1
收藏
0
当前安装
32
版本数
在 OpenClaw 中安装
/install torchliquidationbot
功能描述
Autonomous vault-based liquidation keeper for Torch Market lending on Solana. Scans all migrated tokens for underwater loan positions using the SDK's bulk lo...
安全使用建议
This package appears to be what it claims: an on-chain Torch Market liquidation keeper. Before installing or running it: 1) Do NOT provide your vault authority private key as SOLANA_PRIVATE_KEY — only supply a fresh disposable controller keypair (or let the bot generate one). 2) Verify the program ID (8hbUkon...) and the code provenance (the listed GitHub repos and npm package) yourself before running on mainnet; prefer a test/devnet run first. 3) If you install the optional npm package, confirm the package name/version and checksum match the upstream repo; the code is also bundled under lib/ so you can run/inspect locally. 4) Understand the bot will build and submit transactions that move funds from the vault when authorized — ensure the vault's on-chain authority and link setup are correct and that the human principal retains control. 5) Note a minor registry parsing issue: the top-level metadata displayed env vars as "[object Object]"; refer to SKILL.md/agent.json for the authoritative variable list. If you want more assurance, request a signed release from the maintainers or validate the npm tarball and GitHub tags before trusting this in production.
功能分析
Type: OpenClaw Skill
Name: torchliquidationbot
Version: 10.7.1
The skill bundle implements an autonomous liquidation bot for the Torch Market protocol on Solana. The code follows a security-conscious architecture using ephemeral, in-process keypairs and a vault-based escrow system to limit the agent's financial authority. Analysis of the bot logic (lib/kit/index.js) and the underlying SDK (lib/torchsdk/) confirms that private keys are never transmitted or stored, and network activity is restricted to standard Solana RPC calls, price fetching from CoinGecko, and reputation checks via SAID Protocol. The metadata URI fetching in tokens.js includes a 10-second timeout to mitigate potential SSRF/hanging risks, and the overall implementation aligns perfectly with the extensive security documentation provided.
能力标签
能力评估
Purpose & Capability
Name/description, actions, and code (lib/kit, lib/torchsdk, transactions) all match a Solana liquidation keeper: scanning loans, building & signing liquidation transactions, and routing SOL/collateral via a vault. Required env vars (SOLANA_RPC_URL, VAULT_CREATOR, optional SOLANA_PRIVATE_KEY, scan params, logging) are appropriate for this purpose.
Instruction Scope
SKILL.md instructs a continuous scan/execute loop that builds, signs (with an ephemeral or supplied controller keypair), and submits liquidation transactions. This is within scope for a keeper. Two points to note: (1) SKILL.md intentionally sets disable-model-invocation: true (the bot will not run autonomously) — good mitigation; (2) the operator must follow the explicit guidance to never supply a vault authority key as SOLANA_PRIVATE_KEY because the bot will sign on-chain transactions that pull funds from the vault when authorized.
Install Mechanism
The registry shows no top-level install spec (instruction-only) but SKILL.md / agent.json include an optional npm install (torch-liquidation-bot and torchsdk). The bundled source is present in lib/, so an install is optional. Optional npm installs are a normal pattern, but users should verify the npm package identity/version and prefer running the bundled code or inspecting the npm package before installing.
Credentials
Requested environment variables map to the bot's operation: RPC endpoint, vault creator pubkey, optional controller private key (explicitly flagged as disposable), scan tuning, and logging. No unrelated secrets or high-privilege credentials are requested. The manifest/UI rendering had a parsing artefact (shows repeated "[object Object]"), but SKILL.md and agent.json enumerate the env vars clearly.
Persistence & Privilege
The skill does not request always:true and sets disable-model-invocation: true — it will not be auto-invoked by the agent. It does not request system config paths or other skills' credentials. The skill will sign transactions locally (in-process or with an ephemeral keypair); that level of privilege is expected for a keeper but requires operator caution.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install torchliquidationbot - 安装完成后，直接呼叫该 Skill 的名称或使用
/torchliquidationbot触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v10.7.1
- Updated to version 10.7.1.
- Added new risk documentation (risk.md) to improve transparency and user understanding of operational risks.
- Updated install instructions to reference the latest npm package version.
v10.5.2
- Updated version to 10.5.2.
- Replaced obsolete SDK files (`lib/torchsdk/gateway.*`) with new kit constants files (`lib/kit/constants.*`).
- Expanded environment variable support with new optional variables: `SCAN_INTERVAL_MS`, `SCAN_LIMIT`, `MIN_AGENT_BALANCE_SOL`, `LOG_LEVEL`, `LOG_FORMAT`.
- Updated install instructions and metadata to reflect new package version and configuration options.
v10.0.0
**Major update with new SDK libraries, improved structure, and revised documentation.**
- Integrated full Torch SDK and bot source into `lib/torchsdk/` and `lib/kit/` directories.
- Replaced old audit/design docs with modular SDK and program documentation files.
- Updated environment variable configuration with clearer separation and additional options.
- Improved documentation with detailed key management, vault interaction, and operational guarantees.
- Set up new npm install instructions and clarified compatibility requirements.
v4.0.4
No user-facing changes detected in this release. Version bump only.
- Version number updated to 4.0.4.
- No changes to files, functionality, or documentation content.
- latest sdk v3.7.23 bundled
v4.0.3
No functional or user-facing changes; version number updated.
- Bumped version to 4.0.3 in metadata for consistency.
- No code or documentation changes detected.
- fix metadata parse issue
v4.0.2
- Version bump to 4.0.2 with metadata updates (version and install block).
- Updated NPM install instructions/metadata from 4.0.0 to 4.0.1.
- No code or functional changes; documentation and metadata only.
- added withTimeout helper
v4.0.1
torchliquidationbot v4.0.1
- Updated skill compatibility section to clarify environment variable requirements.
- Explicitly states that disable-model-invocation is set to true, requiring explicit user initiation.
- Minor metadata corrections (version field corrected; rewording in compatibility and metadata fields).
- No functional or implementation changes to code.
v4.0.0
Version 4.0.0 introduces major efficiency and scanning improvements:
- Upgraded to torchsdk v3.7.22.
- Liquidation scanning now uses the SDK's bulk loan scanner (`getAllLoanPositions`), performing a single RPC call per token to retrieve and sort all loan positions by health.
- Greatly reduces RPC load and increases scanning speed compared to previous versions.
- Documentation and SKILL metadata updated for improved environment variable handling and clarity.
- Added explicit support for optional `SOLANA_PRIVATE_KEY` (agent keypair remains disposable by default).
- New documentation file (`verification.md`) added.
v3.0.2
- Bump version to 3.0.2.
- Updated package metadata to reference version 3.0.2 in all relevant fields (package, version, install instructions).
- Enforce consistency for clarity across all metadata and files, do not want any confusion.
v3.0.1
- Added VAULT_CREATOR as a required environment variable for improved configuration safety and clarity.
- Updated all documentation and examples to consistently use SOLANA_RPC_URL and VAULT_CREATOR (instead of obsolete RPC_URL).
- Minor install instructions and usage examples updated to match new environment requirements.
- No code or logic changes; environment variable requirements clarified and enforced.
v3.0.0
**Major Update: liquidator bot upgraded from read-only scanner to full autonomous liquidation keeper with vault-based custody and agent safety.**
- Adds full liquidation functionality—bot now discovers underwater loans (LTV > 65%) and executes liquidation transactions automatically via a linked Torch Vault.
- Introduces secure agent architecture: generates a disposable keypair on each start; agent holds no assets and can be unlinked at any time.
- All assets (SOL and collateral) flow through a human-controlled vault, separating agent control from principal assets.
- Updates environment variables: requires `SOLANA_RPC_URL` and `VAULT_CREATOR` (vault owner); agent wallet is generated automatically unless a private key is provided.
- Source architecture is refactored and modularized (core logic now under `lib/kit/`), leveraging the newest torchsdk v3.2.3.
- Documentation updated to reflect operational keeper role, agent/vault custody model, and precise setup instructions.
v2.1.2
- Updated version to 2.1.2 (no code changes).
- Clarified that read-only metadata fetches use Irys gateway and CoinGecko (for SOL/USD price) in addition to Solana RPC.
- Noted that `@coral-xyz/anchor` and `@solana/spl-token` remain as transitive dependencies in the bundled torchsdk.
- Expanded permissions/network section to specify no secrets or RPC_URL are ever forwarded beyond the expected endpoints.
v2.1.1
- Removed unused SDK files (quotes.js, said.js, transactions.js) from lib/torchsdk/.
- Bundled torchsdk is now stripped to only include the methods used by lib/bot/, reducing package size and attack surface.
- Updated documentation to clarify that the only external dependency is @solana/web3.js and the bundled torchsdk contains only read-only methods.
- No changes to functionality; remains fully read-only and requires only an RPC endpoint.
v2.1.0
- Torch SDK (v2.0.0) is now fully bundled within the skill package in lib/torchsdk/ for auditability—no external torchsdk or agentkit npm dependencies required at runtime.
- Compatibility metadata updated: the only external npm dependency is @solana/web3.js; all other core code is bundled and verifiable on disk.
- Skill version updated to 2.1.0.
- Skill remains read-only; no changes to functionality or environment variables.
v2.0.9
v2.0.9: Source-bundled release — all bot source included in skill package
- Full bot source code is now bundled in lib/bot/ for built-in auditability; no npm install is needed for core functionality.
- Documentation updated to clarify that all logic is included, and users can review every claim on disk.
- npm install remains supported and optional (for those preferring npm/GitHub workflows).
- No wallet, signing, or state mutation functionality added; still strictly read-only.
v2.0.8
- Bumped version to 2.0.8.
- Updated all install and version references to 2.0.8.
- Added agent.json metadata file.
- No changes to skill functionality or architecture.
v2.0.7
## v2.0.7
- OpenClaw metadata updated: `RPC_URL` is now explicitly declared as a required environment variable.
- `disable-model-invocation` moved to top-level frontmatter for stronger enforcement in the registry.
- Install instructions improved to reference version 2.0.7 and OpenClaw-specific install commands.
- No changes to code or functionality; compatibility and auditability remain unchanged.
v2.0.6
Version 2.0.6
- Added metadata links to Solana agent kit and npm pages for SDK dependencies.
- Updated compatibility and metadata to set disableModelInvocation: true, preventing autonomous agent invocation.
- Improved documentation with detailed security, installation audit, and supply chain verification instructions.
- Clarified npm version pinning and explicit install command for added safety.
- No changes to the codebase or functionality; documentation and metadata updates only.
v2.0.5
- Updated description for improved clarity and to highlight support for optional MINT and LOG_LEVEL parameters.
- No code or functional changes; documentation only.
- skill now correctly points to the readonly bot source code on github: https://github.com/mrsirg97-rgb/torch-liquidation-bot-ro, and the npm package has been updated to point at this too: https://www.npmjs.com/package/torch-liquidation-bot, all with the correct v2.0.5 to match
- Version bump to 2.0.5.
v2.0.4
- Version bump to 2.0.4; no code or documentation changes detected.
- ensure all metadata and readmes reflect the same v2.0.4 aligned with the npm package and readonly github
- All functionality, config, and requirements remain unchanged.
- all torchsdk code is open source and available for public use
元数据
常见问题
Torch Liquidation Bot 是什么？
Autonomous vault-based liquidation keeper for Torch Market lending on Solana. Scans all migrated tokens for underwater loan positions using the SDK's bulk lo... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 2666 次。
如何安装 Torch Liquidation Bot？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install torchliquidationbot」即可一键安装，无需额外配置。
Torch Liquidation Bot 是免费的吗？
是的，Torch Liquidation Bot 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
Torch Liquidation Bot 支持哪些平台？
Torch Liquidation Bot 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Torch Liquidation Bot？
由 mr brightside（@mrsirg97-rgb）开发并维护，当前版本 v10.7.1。
推荐 Skills