vybes.fun

Solana token launchpad with prediction markets, AI logo generation, and website builder. Launch tokens (FREE), generate logos, create predictions, build webs...

The skill's API instructions are coherent with a Solana launchpad, but the packaged files contain an unexpected admin HTML page (admin-set-reserves.html) that: (1) includes a plaintext Helius Devnet RPC API key, and (2) documents a 'required signer' authority wallet able to change bonding-curve reserves. Before installing or using this skill: - Treat the package as untrusted static content: do not open the admin page or connect your real wallet to it unless you control the documented authority key. - The embedded devnet RPC key may be a leftover/test key; avoid relying on it and do not expose your own keys to these files. - Verify the skill's source and homepage (none provided) and ask the publisher why an admin tool is included and why credentials are embedded. - If you plan to use the skill with any wallet, use a throwaway/test wallet and never use your primary/private keys. Additional information that would reduce uncertainty: confirmation from the publisher about the admin file's purpose, whether the embedded RPC key is intentionally public/dev-only, and whether the admin page is intended for distribution.

Type: OpenClaw Skill Name: vybes-fun Version: 1.0.0 The skill bundle contains an undocumented administrative utility, 'admin-set-reserves.html', which allows for the modification of Solana bonding curve reserves. This file includes a hardcoded Helius RPC API key (a59878e8-c5f9-4916-a7f7-bd6879496f4c), representing a credential leak. While the tool targets Devnet and requires a specific authorized signer, its inclusion in a general user skill bundle is a high-risk oversight. The primary documented skills in 'skill.md' for token launching and prediction markets on vybes.fun appear consistent with the stated purpose, but the presence of sensitive dev tools is irregular.