Torch Prediction Market Kit
Analysis
This is a disclosed live Solana market bot that can continuously create markets and spend vault funds, so it should be carefully reviewed and tightly limited before use.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
This is not a read-only scanner. This is a fully operational market maker that generates its own keypair, verifies vault linkage, creates tokens, seeds liquidity, and resolves markets autonomously in a continuous loop.
The skill explicitly performs on-chain financial actions, including creating tokens and seeding liquidity from a vault, rather than only providing analysis or read-only monitoring.
It reads your `markets.json` file, creates Torch tokens for pending markets, seeds them with initial liquidity from your vault, monitors price and volume, and resolves them at the deadline
A local file drives multiple on-chain actions; incorrect or tampered market entries can propagate into irreversible blockchain transactions and vault-funded liquidity.
while (true) { ... await marketCycle(connection, log, config.marketsPath, config.vaultCreator, agentKeypair); ... setTimeout(resolve, config.scanIntervalMs)The entrypoint implements an indefinite autonomous loop with no built-in end condition beyond stopping the process.
const torchsdk_1 = require("torchsdk");Core transaction behavior depends on a package-name import. Combined with the registry stating there is no install spec and the artifacts referencing optional npm installation, users should verify which torchsdk package/version will actually execute.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
"SOLANA_PRIVATE_KEY", "description": "Disposable controller keypair ... Optional ... If provided, should be a fresh keypair with ~0.01 SOL for gas. Holds no value. All market capital lives in the vault.", "sensitive": true
The private key is optional and described as disposable, but it is still sensitive signing authority and is paired with a vault link for delegated on-chain actions.