Pumpclaw

• Analyzed: May 12, 2026, 3:16 AM
• Findings: 1
• Version: 2.1.0
• Hash: 97a11538ee2aeefdcc9d8ff4ec2dab4450aecbec78996c31f781c59ed4431497
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle 'token-launcher' is designed for deploying and managing ERC20 tokens on the Base blockchain. The `SKILL.md` provides clear instructions for setting the `BASE_PRIVATE_KEY` environment variable, which is then used by the `scripts/pumpclaw.ts` and `scripts/swap.ts` files to sign and send blockchain transactions via the `viem` library. All code and documentation align with the stated purpose of creating and managing tokens, claiming fees, and performing swaps. There is no evidence of data exfiltration (beyond necessary blockchain interactions), malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts designed to mislead the AI agent into unauthorized actions. The use of a private key is inherent to the skill's functionality and is explicitly documented.