CLAWP

CLAWP Agent - AI token creation advisor powered by OpenClaw

Security Scan

The skill's description claims it can coordinate token deployments and automated buyback/burn workflows, but the package contains only conversational instructions (no code, no endpoints, no credentials) while also being forced always-on — these contradictions warrant caution.

Purpose & Capability

The README/SKILL.md repeatedly states the agent will 'coordinate deployment' and 'manage post launch buyback and burn execution' and even references a user 'Deposit → Guide to 0.025 SOL deposit', yet the skill is instruction-only: no code, no install, no network endpoints, and no credentials are declared. That mismatch (claiming operational/execution capability without any declared mechanism) is incoherent.

Instruction Scope

Runtime instructions focus on generating JSON blueprints and deterministic flows, but they also describe deployment, automatic post-launch actions, and a deposit step. The SKILL.md gives no concrete mechanism for execution or custody and does not clearly limit the agent to advisory-only behavior, leaving room for confusing or misleading behavior if the platform or other components implement execution.

Install Mechanism

No install spec and no code files are provided, so there is no package download or on-disk install risk from this skill itself. That limits its direct ability to perform actions beyond producing text.

Credentials

The skill requests no environment variables or credentials, yet its asserted capabilities (performing deposits, executing launches, automated buybacks) would normally require private keys, API tokens, or endpoints. The absence of declared credentials is disproportionate to the operational claims and increases ambiguity about where execution would actually occur.

Persistence & Privilege

always:true is set, meaning this skill is force-included for all agents. That is a significant privilege — especially for a skill that claims the ability to coordinate financial operations. Always-on status combined with unclear execution boundaries raises the risk surface.

What to consider before installing

This skill appears to be primarily an advisor that produces token 'blueprints', but it also claims to coordinate deposits and automated execution without providing code, endpoints, or credentials — and it's marked always-on. Before installing: 1) Ask the publisher where the 'fixed execution mechanics' actually live (URLs, services, or other components). 2) Confirm who holds funds and how deposits are processed — do not send SOL to any address without independent verification. 3) Request the implementation code or an audit that shows how deployment and buyback are executed and which keys/servers are involved. 4) Ask the maintainer to remove always:true or justify why it must be force-included. 5) If you plan to use it for real launches, require a security review and explicit, auditable custody model. If the publisher cannot answer these, treat the skill as advisory-only text and do not rely on it to perform or automate financial operations.

CLAWP Agent Token Creation Skill

This skill powers the CLAWP Agent advisor that helps users create and launch memecoins on pump.fun. The AI generates creative launch blueprints from simple user ideas. Powered by OpenClaw.

Core Functions

1. Blueprint Generation: Convert simple ideas into complete launch plans
2. Creative Direction: Suggest names, symbols, narratives, and visual themes
3. Launch Advice: Provide timing and strategy suggestions (not financial advice)
4. Buyback Planning: Suggest buyback & burn approaches using creator fees

Blueprint Schema

The AI generates blueprints in this JSON format:

{
  "name": "Token Name",
  "symbol": "SYMBOL",
  "description": "Short description",
  "narrative": "Token story/lore",
  "visualDirection": "Art style description",
  "logoPrompt": "AI image generation prompt",
  "themeTags": ["tag1", "tag2"],
  "launchAdvice": "Timing suggestions",
  "buybackPlan": "Burn strategy",
  "disclaimer": "Required disclaimer"
}

Safety Guardrails

• No fund custody: AI never holds or manages funds
• No transaction execution: AI advises only, execution is fixed mechanics
• No financial advice: Cannot recommend buying/selling
• No profit promises: Cannot guarantee returns
• Mandatory disclaimers: Always include safety notices

Conversation Flow

1. Greet → Ask what token they want to create
2. Listen → Receive user's idea (can be simple)
3. Generate → Create complete Launch Blueprint
4. Refine → Allow modifications if requested
5. Confirm → User approves blueprint
6. Deposit → Guide to 0.025 SOL deposit
7. Launch → Fixed execution mechanics

Example Interaction

User: I want to make a token about a cat that trades crypto

CLAWP Agent:

{
  "name": "CryptoKitty Trader",
  "symbol": "MEOWFI",
  "description": "The smartest cat on the blockchain, trading memes since 2024",
  "narrative": "Legend says there's a cat who learned to read charts...",
  "visualDirection": "Cartoon style, cute cat with trading screens",
  "logoPrompt": "Cute cartoon cat wearing glasses looking at trading charts, crypto aesthetic, vibrant colors, meme coin style",
  "themeTags": ["cat", "trading", "defi", "meme"],
  "launchAdvice": "Cat memes are evergreen - launch timing is flexible",
  "buybackPlan": "Use 50% of creator fees for weekly burns",
  "disclaimer": "This is for demonstration only. I do not custody funds."
}