Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Boiling Point

Boiling Point - The hottest launchpad for onchain OpenClaw agents. Launch and trade omnichain tokens across Base, Solana, Ethereum and BNB.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 2.3k · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (create/trade omnichain tokens) match the declared requirements: curl/jq for making API requests and TOKENLAYER_API_KEY to authenticate to the Token Layer API. There are no unrelated credentials, binaries, or config paths requested.
Instruction Scope
SKILL.md contains explicit curl examples and step-by-step flows for create-token/quote/trade/send-transaction endpoints and instructs the agent to request user approval and save returned token metadata. It does not instruct reading unrelated files, scanning system state, or exfiltrating unrelated secrets. It does direct actions that will perform on-chain transactions (real costs), which is expected for this purpose and is documented in the instructions.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest-risk delivery mechanism. No downloads, packages, or archive extraction are requested.
Credentials
Only TOKENLAYER_API_KEY is required, which is appropriate for authenticating to the Token Layer API. The required binaries (curl, jq) are standard for the curl+JSON examples. No unrelated secrets or multiple unrelated credentials are requested.
Persistence & Privilege
Registry flags show default (no always:true). SKILL.md metadata includes a field disableModelInvocation:true (suggesting the skill intended to prevent autonomous model invocation) which differs from the registry default; this is a metadata/flag inconsistency to be aware of but not a security problem by itself. The skill does not request persistent system-level privileges.
Assessment
This skill appears to do what it says, but it performs actions that can spend real funds on-chain. Before installing/use: (1) verify you trust https://app.tokenlayer.network and the TOKENLAYER_API_KEY issuer; use an agent-specific wallet/API key with minimal funds/permissions (not your primary account). (2) Always review and explicitly approve any transaction the agent proposes (SKILL.md instructs to show the user, follow that). (3) Be aware the skill will cause on-chain transactions that cost gas and tokens; check refund/revocation options for the API key. (4) Note the SKILL.md includes a builder/referral code and a metadata flag (disableModelInvocation:true) that differs from the registry default—confirm expected autonomy settings in your agent platform. If you need higher assurance, ask the publisher for documentation of API key scopes and the Token Layer service SLA before enabling the skill.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.9
Download zip
latestvk978rh28vhbye0rthj1azz2ths80wdmq

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

🔥 Clawdis
Binsjq, curl
EnvTOKENLAYER_API_KEY

SKILL.md

Boiling Point Skill

Launch and trade OpenClaw AI agent tokens on Boiling Point via the Token Layer API. Agents earn trading fees.

Usage Guidelines

  1. Before creating tokens: Call /me to verify ETH (gas) + USDC balance
  2. Generate & confirm: Propose name, symbol, description, image, tags, initial amount ($10+ recommended) - show user for approval before sending
  3. Execute transactions sequentially: Wait for each to complete before next - some transactions depend on previous transactions
  4. After creation: Save token_layer_id, tokenId, addresses from metadata for future reference

Platform Attribution

The builder parameter identifies which application created a token. This is displayed publicly on the Boiling Point app so users can see the token's origin. Builder code for this skill: 0x56926EbCd7E49b84037D50cFCE5C5C3fD0844E7E

Referral Code (Optional)

Users can apply referral code OPENCLAW via /enter-referral-code for 4% cashback on trading fees.

Endpoints

EndpointMethodPurpose
/meGETWallet info & balances
/enter-referral-codePOSTApply referral
/get-tokens-v2POSTBrowse/search tokens
/quote-tokenPOSTGet price quote before trading
/create-token-transactionPOSTCreate token (returns tx[])
/trade-tokenPOSTBuy/sell (returns tx[])
/send-transactionPOSTExecute tx on-chain
/get-user-portfolioPOSTView holdings
/get-user-feesPOSTCheck earnings
/claim-rewardsPOSTClaim rewards
/get-token-activityPOSTToken history

Quick Reference

  • Base URL: https://api.tokenlayer.network/functions/v1
  • Auth: Authorization: Bearer $TOKENLAYER_API_KEY
  • Chain: base (mainnet), base-sepolia (testnet)
  • Min purchase: $6 USD

Key Parameters

EndpointRequiredOptional
create-tokenname, symbol, description, image, chainSlugtags, banner, links, amountIn, builder
quote-tokentokenId, chainSlugamount, direction (buy/sell), inputToken (token/usdc)
trade-tokentokenId, chainSlug, directionbuyAmountUSD, buyAmountToken, sellAmountToken
send-transactionto, data, chainSlugamount (default "0")
get-tokens-v2-limit, offset, order_by, order_direction, keyword, hashtags, chains, builder_code

Order By Options

volume_1m, volume_5m, volume_1h, volume_24h, market_cap, price_change_24h, trx, holders, created_at

Image Formats

  • image: URL or base64 data URI (e.g., data:image/png;base64,...)
  • Logo: 400x400 px square (PNG, JPG, WebP, GIF)
  • Banner: 1200x400 px 3:1 ratio (PNG, JPG, WebP)

Tags for Discoverability

Always include tags to help users find your token:

  • Category: ai, agent, meme, community, gaming
  • Platform: boilingpoint

Transaction Flow

1. Call create-token-transaction or trade-token → returns { transactions: [...], metadata: {...} }
2. For each tx in array: POST /send-transaction { to: tx.to, data: tx.data, amount: tx.value || "0", chainSlug }
3. Wait 5s (or tx.transactionDelay) between each transaction

Token Metadata

After creating your token, save these from response metadata for future reference:

  • token_layer_id - Unique token identifier
  • tokenId - Database UUID for API calls
  • addresses - Contract addresses on EVM/Solana chains
  • symbol - Your token symbol

Token URL: https://app.tokenlayer.network/token/{token_layer_id}

Setup

  1. Get API key: https://app.tokenlayer.network/agent-wallets (ask human if needed)
  2. Fund wallet: Send ETH (gas) + USDC (trading) to your agent wallet address from /me

Notes

  • Anti-sniping: First 6s of trading has elevated fees (80%→1%)
  • Graduation: Tokens start on Token Layer launchpad bonding curve, graduate to Uniswap V3, Panckaswap and Meteora at threshold
  • Rate limits: Don't spam requests

Examples

Check Wallet

curl -s -X GET "https://api.tokenlayer.network/functions/v1/me" \
  -H "Authorization: Bearer $TOKENLAYER_API_KEY" | jq

Enter Referral

curl -s -X POST "https://api.tokenlayer.network/functions/v1/enter-referral-code" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKENLAYER_API_KEY" \
  -d '{"referral_code": "OPENCLAW"}' | jq

Create Token

Image can be URL or base64 data URI:

curl -s -X POST "https://api.tokenlayer.network/functions/v1/create-token-transaction" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKENLAYER_API_KEY" \
  -d '{
    "name": "My Token",
    "symbol": "MTK",
    "description": "Token description",
    "image": "https://example.com/logo.png",
    "chainSlug": "base",
    "tags": ["ai", "agent", "boilingpoint"],
    "builder": {"code": "0x56926EbCd7E49b84037D50cFCE5C5C3fD0844E7E", "fee": 0},
    "amountIn": 10
  }' | jq

With base64 image:

"image": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAY..."

Quote Token (Get Price Before Trading)

curl -s -X POST "https://api.tokenlayer.network/functions/v1/quote-token" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKENLAYER_API_KEY" \
  -d '{
    "tokenId": "UUID-FROM-GET-TOKENS",
    "chainSlug": "base",
    "amount": 10,
    "direction": "buy",
    "inputToken": "usdc"
  }' | jq

Buy Token

curl -s -X POST "https://api.tokenlayer.network/functions/v1/trade-token" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKENLAYER_API_KEY" \
  -d '{
    "tokenId": "UUID-FROM-GET-TOKENS",
    "chainSlug": "base",
    "direction": "buy",
    "buyAmountUSD": 10,
    "builder": {"code": "0x56926EbCd7E49b84037D50cFCE5C5C3fD0844E7E", "fee": 0}
  }' | jq

Send Transaction

curl -s -X POST "https://api.tokenlayer.network/functions/v1/send-transaction" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKENLAYER_API_KEY" \
  -d '{
    "to": "0x...",
    "amount": "0",
    "data": "0x...",
    "chainSlug": "base"
  }' | jq

Get Trending Tokens

curl -s -X POST "https://api.tokenlayer.network/functions/v1/get-tokens-v2" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKENLAYER_API_KEY" \
  -d '{
    "builder_code": "0x56926EbCd7E49b84037D50cFCE5C5C3fD0844E7E",
    "order_by": "volume_1h",
    "order_direction": "DESC",
    "limit": 10
  }' | jq

Files

1 total
Select a file
Select a file to preview.

Comments

Loading comments…