Labor Solana skill: Solana ecosystem

Transfers native SOL on Solana to a recipient address using a funded signing key from environment configuration. Use when the user asks to send SOL, transfer...

Security Scan

The skill's code, runtime instructions, and requested secret (SOLANA_PRIVATE_KEY) are consistent with its stated purpose of sending native SOL; nothing in the bundle demands unrelated privileges or suspicious network endpoints.

Purpose & Capability

Name/description match the implementation: the code and scripts implement a native SOL transfer using @solana/web3.js. Required binary (node) and primary env var (SOLANA_PRIVATE_KEY) are appropriate for this functionality.

Instruction Scope

SKILL.md gives constrained, explicit runtime instructions (only run the provided npm transfer command, require explicit user confirmation, prefer devnet). One minor mismatch: SOLANA_RPC_URL is referenced as an optional env var in docs/instructions but is not listed in the registry requires.env metadata — this is informational, not a functional mismatch. The instructions do not ask to read unrelated files or exfiltrate data; outputs include explorer URLs only.

Install Mechanism

No automated install spec in registry; SKILL.md instructs the operator to run 'npm install' and 'npm run build' in the skill folder. Dependencies are from the npm registry (@solana/web3.js, bs58) — standard for this purpose. This requires writing packages to disk (normal for running the node CLI) but does not pull from arbitrary URLs.

Credentials

Only SOLANA_PRIVATE_KEY is required (primary credential). Optionally referencing SOLANA_RPC_URL is reasonable and proportional for choosing an RPC endpoint. No unrelated secrets or extra credentials are requested.

Persistence & Privilege

The skill is not forced always-on (always:false) and does not request elevated system-wide privileges. It contains scripts that the agent may run (npm build/run) but does not modify other skills or global agent config. Note: normal autonomous invocation remains enabled by platform defaults.

Assessment

This skill appears to be what it says: a Node-based Solana native SOL transfer CLI that expects your SOLANA_PRIVATE_KEY in an environment secret. Before using: (1) verify the private key is provided via a secure secret store (do not paste keys into chat); (2) test on devnet first; (3) if sending from mainnet, ensure SOLANA_RPC_URL points to a trusted RPC and explicitly confirm the transaction; (4) inspect the included source (src/) and package.json if you want to audit dependencies; and (5) be aware the agent may run npm install/build in the skill directory — run in an isolated environment if you have concerns. If you lack trust in the skill author, do not provide your mainnet private key.

Solana native SOL transfer

When to use

Apply this skill when the user wants to send native SOL (not SPL tokens) from their wallet to another Solana address.

Preconditions

1. Node.js is available on PATH (node).
2. User has set SOLANA_PRIVATE_KEY (see README — never commit or paste keys into chat). Optionally set SOLANA_RPC_URL (defaults to public devnet).
3. Dependencies installed once in this skill folder: npm install (or npm ci).
4. This skill uses TypeScript source compiled to JavaScript via npm run build and does not require Solana CLI (solana) or Python.

Safety

• Do not echo, log, or copy the private key. Use env vars or OpenClaw secrets only.
• Prefer devnet for testing. For mainnet-beta, require explicit user confirmation and a SOLANA_RPC_URL pointing at mainnet (or user clearly opts in).
• Reject transfers to invalid addresses. Confirm recipient and amount with the user for non-trivial sums.

How to run the transfer

From the directory that contains this SKILL.md (skill root), after npm install:

SOLANA_RPC_URL="${SOLANA_RPC_URL:-https://api.devnet.solana.com}" \
SOLANA_PRIVATE_KEY="<set-by-user-or-secrets>" \
npm run transfer -- --to "<RECIPIENT_PUBKEY>" --sol "<AMOUNT_SOL>"

• --to — base58 public key of the recipient.
• --sol — amount in SOL (decimal string or number, e.g. 0.01).
• Optional: --rpc <url> overrides SOLANA_RPC_URL.

On success, report the signature (transaction id) and a Solscan link (explorerUrl in CLI output) using the appropriate cluster (devnet vs mainnet-beta).

On failure, report the error message from the script without exposing secrets.

Execution constraints (important)

• Use only this command path: npm run transfer -- --to ... --sol ....
• Do not switch to scripts/transfer_sol.py, .skill bundles, or any Python flow.
• Do not require solana CLI for this skill; transfers are sent via @solana/web3.js.

Mandatory user-facing workflow

Always show a visible step plan before execution and mark completed steps with a green indicator.

Use this exact checklist style in chat:

• 🟩 Step 1 - Collect input when done, otherwise ⬜ Step 1 - Collect input
• 🟩 Step 2 - Validate input when done, otherwise ⬜ Step 2 - Validate input
• 🟩 Step 3 - User confirmation when done, otherwise ⬜ Step 3 - User confirmation
• 🟩 Step 4 - Execute transfer when done, otherwise ⬜ Step 4 - Execute transfer
• 🟩 Step 5 - Report result when done, otherwise ⬜ Step 5 - Report result

Step 1 - Collect input (ask if missing)

Required input:

• recipient address (to)
• amount in SOL (sol)
• network (devnet or mainnet-beta, default devnet)

If any field is missing, ask follow-up questions. Do not execute until all fields are present.

Step 2 - Validate input

Validate:

• recipient is a valid base58 Solana address
• amount is numeric and positive
• network is one of: devnet, mainnet-beta

If validation fails, explain the exact invalid field and stop.

Step 3 - User confirmation (strict gate)

Before running any command, send a confirmation summary and ask user to confirm:

• To: recipient
• Amount: SOL amount
• Network: selected network
• Source wallet: signer public key (if available)

Only continue on explicit confirmation such as: confirm, yes, or equivalent. If user rejects/corrects any value, cancel current run and return to Step 1.

Step 4 - Execute transfer

Run only after confirmation:

SOLANA_RPC_URL="${SOLANA_RPC_URL:-https://api.devnet.solana.com}" \
SOLANA_PRIVATE_KEY="<set-by-user-or-secrets>" \
npm run transfer -- --to "<RECIPIENT_PUBKEY>" --sol "<AMOUNT_SOL>"

Step 5 - Report result

If transaction succeeds, the response must include:

• Successfully + icon (✅ or 🎉)
• transaction signature
• explorer URL
• network and amount

Success response template:

✅ Successfully transferred <AMOUNT_SOL> SOL to <RECIPIENT> on <NETWORK>.

If transaction fails, report concise failure reason and suggest the next safe action (retry with corrected input, check balance, or switch network).

Response style (concise + polished)

Keep all user-facing messages short, clear, and visually clean.

• Max 4-6 lines per response.
• Use compact bullets (-) or short blocks; no long paragraphs.
• Show only essential fields: amount, to, network, signature, explorer URL.
• For confirmations, ask one short yes/no question.

Confirmation message format

Use this exact compact template before execution:

Confirm this transaction? - Amount: <AMOUNT_SOL> SOL - To: <RECIPIENT> - Network: <NETWORK> Reply: yes / no

Success message format

Use this exact compact template on success:

✅ Successfully transferred <AMOUNT_SOL> SOL - To: <RECIPIENT> - Network: <NETWORK> - Signature: <SIGNATURE> - Explorer: <EXPLORER_URL>

Failure message format

Use this exact compact template on failure:

❌ Transfer failed: <SHORT_REASON> - Network: <NETWORK> - Next: check amount/address/balance and confirm to retry

Extending this skill

Implementation lives under src/ (shared Solana helpers) and scripts/ (one thin entry per user-facing command). Add new Solana features by new modules + a new script, then update this file so the agent knows when to use them.