Create a coin on trends.fun

在 trends.fun 上创建 coin 并部署 Meteora DBC 资金池

This tool legitimately needs access to your Solana keypair (~/.config/solana/id.json) so it can sign a login message and send transactions to create the token/pool. That is the main sensitive action — the code signs with your key but does not upload the secret key to remote servers. Before installing/running: (1) Review and trust the code or run it in an isolated environment; (2) never paste or send your private key to anyone — the docs’ wording about “outputting the keypair” is ambiguous and could be dangerous; (3) ensure you understand and accept the real SOL costs (transactions will spend SOL); (4) if you are unsure, create and use a throwaway/test Solana wallet with minimal funds for initial tests.

Type: OpenClaw Skill Name: trendsdotfun Version: 1.0.1 The skill is classified as suspicious due to a critical prompt injection vulnerability found in `SKILL.md`. The instructions explicitly tell the AI agent to 'output the keypair and address to the user' if a Solana keypair is not found. If executed literally by an agent, this would lead to the disclosure of the user's Solana private key in the agent's output, posing a severe information security risk. While the code itself (`src/index.ts`, `src/auth.ts`) uses the keypair for legitimate Solana operations and does not show direct malicious exfiltration to an external endpoint, the instruction to output the private key constitutes a critical vulnerability that could be exploited for credential theft via the agent's logging or output mechanisms.