FairScale Solana

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill is mostly a wallet-reputation API wrapper, but its docs describe automatic USDC payments from an agent wallet without clear approval, limits, or declared payment credentials.

Review the payment model before installing. If you use this skill, do not give the agent access to a funded Solana wallet unless you have explicit per-call approval and spending limits. Also confirm the correct FairScale endpoint and API-key header before entering credentials.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

If the agent has access to a funded wallet, repeated wallet checks could incur USDC charges without the user clearly approving each paid action.

Why it was flagged

This describes automatic paid requests from an agent wallet, but the artifacts do not define an approval prompt, budget, spending cap, or user confirmation workflow.

Skill content

No setup needed! If your agent has a Solana wallet with USDC, it can pay per request automatically.

- Single wallet: $0.05 USDC
- Batch (10 wallets): $0.40 USDC

Recommendation

Require explicit user confirmation before any paid x402 request, publish spending limits, and make the paid path opt-in rather than automatic.

Medium

#ASI03: Identity and Privilege Abuse

What this means

Users may not realize the skill can require paid account credentials or wallet spending authority until after installation or use.

Why it was flagged

The skill documents use of a FairScale API key, and also documents wallet-funded requests, while the registry declares no required credentials or environment variables. The credential/payment boundary is therefore under-declared.

Skill content

openclaw config set skills.entries.fairscale-solana.env.FAIRSCALE_API_KEY "your_key"

Recommendation

Declare FAIRSCALE_API_KEY and any wallet/payment requirements in metadata, and clearly explain what authority the skill needs and how charges are authorized.

Low

#ASI09: Human-Agent Trust Exploitation

What this means

Users may make setup or trust decisions based on incomplete or inconsistent authentication details.

Why it was flagged

This differs from the included API reference and script, which use api2.fairscale.xyz and a fairkey header. The inconsistency may confuse users about whether authentication is required and where credentials are sent.

Skill content

Free tier: No authentication required. Rate limited by IP.

Pro/Enterprise: Include API key in header:
x-api-key: fs_your_api_key_here

Recommendation

Align SKILL.md, README.md, API.md, and scripts so they consistently state the correct endpoint, authentication header, and free/paid behavior.