ClawHub

Labor Solana skill: Solana ecosystem

v1.0.2

Transfers native SOL on Solana to a recipient address using a funded signing key from environment configuration. Use when the user asks to send SOL, transfer...

⭐ 0· 129·0 current·0 all-time
by@0xxbrain01
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the implementation: the code and scripts implement a native SOL transfer using @solana/web3.js. Required binary (node) and primary env var (SOLANA_PRIVATE_KEY) are appropriate for this functionality.
ℹ
Instruction Scope
SKILL.md gives constrained, explicit runtime instructions (only run the provided npm transfer command, require explicit user confirmation, prefer devnet). One minor mismatch: SOLANA_RPC_URL is referenced as an optional env var in docs/instructions but is not listed in the registry requires.env metadata — this is informational, not a functional mismatch. The instructions do not ask to read unrelated files or exfiltrate data; outputs include explorer URLs only.
ℹ
Install Mechanism
No automated install spec in registry; SKILL.md instructs the operator to run 'npm install' and 'npm run build' in the skill folder. Dependencies are from the npm registry (@solana/web3.js, bs58) — standard for this purpose. This requires writing packages to disk (normal for running the node CLI) but does not pull from arbitrary URLs.
✓
Credentials
Only SOLANA_PRIVATE_KEY is required (primary credential). Optionally referencing SOLANA_RPC_URL is reasonable and proportional for choosing an RPC endpoint. No unrelated secrets or extra credentials are requested.
✓
Persistence & Privilege
The skill is not forced always-on (always:false) and does not request elevated system-wide privileges. It contains scripts that the agent may run (npm build/run) but does not modify other skills or global agent config. Note: normal autonomous invocation remains enabled by platform defaults.
Assessment
This skill appears to be what it says: a Node-based Solana native SOL transfer CLI that expects your SOLANA_PRIVATE_KEY in an environment secret. Before using: (1) verify the private key is provided via a secure secret store (do not paste keys into chat); (2) test on devnet first; (3) if sending from mainnet, ensure SOLANA_RPC_URL points to a trusted RPC and explicitly confirm the transaction; (4) inspect the included source (src/) and package.json if you want to audit dependencies; and (5) be aware the agent may run npm install/build in the skill directory — run in an isolated environment if you have concerns. If you lack trust in the skill author, do not provide your mainnet private key.

Like a lobster shell, security has layers — review code before you run it.

latestvk974gpbrh17ns7fn0220j6zv8h83yf48

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Binsnode
EnvSOLANA_PRIVATE_KEY
Primary envSOLANA_PRIVATE_KEY

Comments