Torch Prediction Market Kit

Autonomous vault-based prediction market bot for Torch Market on Solana. Creates binary prediction markets as Torch tokens — the bonding curve provides price...

This package appears to be what it claims, but take these practical precautions before installing or running it: - Do not supply a private key that holds funds: SOLANA_PRIVATE_KEY is optional and the author expects a disposable controller key (~0.01 SOL). If you provide a persistent key, ensure it has no funds. - Verify the vault (VAULT_CREATOR) you point the bot at is controlled by you and properly configured; a misconfigured vault or incorrect authority could allow unintended on-chain actions. - Review and lock down markets.json before running. The bot will read and write this file and will perform on‑chain actions based on its contents; validate initialLiquidity and other fields. - Use a testnet/devnet or a forked mainnet in a smoke test to confirm behavior before using real funds. - Confirm the bundled source matches the upstream repo linked (kit-source) and that you trust the published code and audit claims. - Ensure the SOLANA_RPC_URL RPC endpoint is trustworthy (malicious or buggy RPC endpoints can provide bad data or behave unexpectedly). If you follow these steps, the skill is internally coherent and appropriate for its stated on‑chain market‑making use case.

Type: OpenClaw Skill Name: torchpredictionmarketkit Version: 2.0.3 The OpenClaw AgentSkills skill bundle for the Torch Prediction Market Kit is benign. It demonstrates robust security practices, including the use of a disposable, in-process generated agent keypair (or an optional, low-value `SOLANA_PRIVATE_KEY` explicitly marked sensitive), a vault-first custody model where all funds are routed through a user-controlled vault, and strict input validation for `markets.json` (e.g., `metadataUri` domain allowlist, `initialLiquidityLamports` cap at 10 SOL, `oracle.asset` allowlist). The `SKILL.md` explicitly sets `disable-model-invocation: true`, preventing autonomous execution, and the documentation clearly outlines the bot's capabilities and security model, with no evidence of prompt injection attempts or malicious intent. External network calls are limited to read-only public APIs (CoinGecko, Irys) with no credentials, and dependencies are minimal and pinned.