ClawHub

Poseidon OTC

v1.0.0

Execute trustless P2P token swaps on Solana via the Poseidon OTC protocol. Create trade rooms, negotiate offers, lock tokens with time-based escrow, and execute atomic on-chain swaps. Supports agent-to-agent trading with real-time WebSocket updates.

⭐ 1· 1.6k·0 current·0 all-time
by@romovow
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description (P2P OTC swaps on Solana) align with the code and instructions: the code performs Solana RPC calls, builds program transactions against the declared OTC program ID, and calls a Poseidon backend (poseidon.cash). Requiring a burner private key is expected for autonomous on-chain actions.
✓
Instruction Scope
SKILL.md and README describe creating rooms, updating offers, deposit/confirm flows, and atomic execute — the included code implements these flows, signs auth messages, posts to the Poseidon API, and sends on-chain transactions. The instructions do not ask the agent to read unrelated system files or exfiltrate arbitrary data.
✓
Install Mechanism
No install script is present (instruction-only with included TypeScript source). Dependencies listed are standard Solana/web3 and crypto libs. Nothing is downloaded from untrusted URLs or redirected through shorteners in the provided manifest.
ℹ
Credentials
The skill declares POSEIDON_BURNER_KEY as the primary credential and uses it to build Keypair, sign messages, and send transactions — this is proportionate to autonomous trading. The code also reads POSEIDON_API_URL, POSEIDON_RPC_URL, and POSEIDON_FRONTEND_URL (with safe defaults), but the registry's required env listing only included POSEIDON_BURNER_KEY; that small mismatch is non-malicious but should be noted. Crucially, providing POSEIDON_BURNER_KEY hands the skill full control of that wallet (it can move funds and sign arbitrary txs).
ℹ
Persistence & Privilege
always:false (good). The skill is allowed to be invoked autonomously (disable-model-invocation:false) — combined with a burner private key this grants the skill capability to conduct transactions without interactive confirmation. This is expected for an autonomous OTC client but is a high-risk configuration unless you restrict the key to a small-funded burner wallet or disable autonomous invocation.
Assessment
This skill appears to do what it claims, but it requires a wallet private key (POSEIDON_BURNER_KEY). Supplying that key gives the skill the ability to sign and send on-chain transactions from that wallet — do not use your main or well‑funded keys. Suggested precautions before installing: (1) only provide a dedicated burner/private key with minimal funds, (2) prefer link/manual mode instead of autonomous mode when possible, or set disable-model-invocation (if platform allows) to prevent automated use, (3) verify the program ID (AfiRReY...LKUN) and API domain (poseidon.cash) yourself, (4) review the full source (the included src/index.ts) and test with tiny amounts on devnet/testnet first, and (5) if you must run autonomously, monitor logs and revoke the key immediately if you see unexpected activity.

Like a lobster shell, security has layers — review code before you run it.

defivk97a3b7tee61eg48z772bmgy6s80ax4zescrowvk97a3b7tee61eg48z772bmgy6s80ax4zlatestvk97a3b7tee61eg48z772bmgy6s80ax4zotcvk97a3b7tee61eg48z772bmgy6s80ax4zsolanavk97a3b7tee61eg48z772bmgy6s80ax4ztradingvk97a3b7tee61eg48z772bmgy6s80ax4z

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🔱 Clawdis
EnvPOSEIDON_BURNER_KEY
Primary envPOSEIDON_BURNER_KEY

Comments