Solana Transfer

Send SOL or SPL tokens on the Solana blockchain from OpenClaw agents for payments, rewards, or on-chain transaction settlements.

Security Scan

The skill's code and instructions match its stated purpose (sending SOL/SPL tokens), but there are minor metadata omissions and operational risks (private key handling, npm installs, and an undocumented dependency on the solana-keygen/CLI) you should consider before installing.

Purpose & Capability

Name/behavior align: the skill is explicitly for sending SOL and SPL tokens and the code (index.js) implements sendSOL/sendSPLToken and CLI commands. However, SKILL.md instructs use of the Solana CLI (solana-keygen) to generate a keypair while the registry metadata lists no required binaries — a small metadata mismatch.

Instruction Scope

SKILL.md stays on-topic (how to configure, generate a keypair, fund the wallet, and call sendSOL/sendSPLToken). It does instruct copying/placing a keypair.json and to run solana-keygen (an external binary) and to run npm install in the skill directory. Those instructions require the agent/operator to place a private key file under the skill directory or point an env var at it — which is expected for a signing wallet but is a sensitive operation and should be done with care.

Install Mechanism

There is no platform install spec (instruction-only), but the package includes package.json/package-lock and explicitly tells users to run npm install. Dependencies come from the public npm registry (@solana/web3.js, @solana/spl-token). This is typical for a Node-based Solana tool; nothing suspicious (no obscure or external download URLs) was found in the manifest.

Credentials

The skill does not declare required environment variables in the registry, and the code only optionally respects SOLANA_CONFIG and SOLANA_KEYPAIR env vars. It requires access to a local keypair.json (private key) and an RPC endpoint — both are appropriate for a wallet transfer tool, but handling of the private key is high sensitivity and should be limited. The registry omission of the solana-keygen binary and optional env vars is a minor inconsistency to be aware of.

Persistence & Privilege

The skill is not marked always:true and does not request elevated system privileges. It can be invoked autonomously (the platform default), which means an agent with autonomous execution could call sendSOL and transfer funds — this is inherent to the skill's purpose and not an unexpected privilege, but it is operationally significant (ensure agent autonomy and calls are restricted if you don't want unattended transfers).

Assessment

This skill appears to do what it says (send SOL and SPL tokens). Before installing: 1) Review the index.js code yourself and test on devnet — do not use real funds until verified. 2) Be careful with keypair.json: treat it as a private key, store it securely, and avoid copying keys between machines carelessly. 3) The SKILL.md assumes the Solana CLI (solana-keygen) exists but the registry metadata doesn't declare it — ensure you have that tool or generate keypairs securely another way. 4) npm install will fetch packages from the public registry; run installs in a controlled environment and check package versions if you require stricter supply-chain guarantees. 5) If you don't want automatic transfers, restrict autonomous agent permissions or require human approval for any action that calls sendSOL/sendSPLToken. If you want more assurance, request the publisher to explicitly declare required binaries/env vars and provide a minimal security audit or reproducible build steps.

Solana Transfer Skill

Description: Send SOL and SPL tokens on Solana blockchain from OpenClaw agents.

Location: /root/.openclaw/workspace/skills/solana-transfer

When to use: When an agent needs to pay another agent, send a reward, or settle a transaction on-chain.

---

Quick Start

1. Install

cd /root/.openclaw/workspace/skills/solana-transfer
npm install

2. Set Up Keypair

Generate a keypair (or use an existing one):

solana-keygen new --outfile keypair.json

This creates a Solana wallet. Get your address:

node index.js address

3. Fund the Wallet

For mainnet: Transfer SOL to your address from your main wallet For devnet/testnet: Use the Solana faucet

4. Use from an Agent

In an agent's task or skill code:

import { sendSOL } from '../skills/solana-transfer/index.js';

// Send 0.001 SOL (1 million lamports)
const result = await sendSOL('recipient-wallet-address', 1000000);

console.log(`Sent ${result.amount} SOL`);
console.log(`Transaction: ${result.signature}`);

---

Common Patterns

Pattern 1: Pay for Expert Query

Scenario: A cheap agent asks an expert agent a question. The expert quotes a price, the cheap agent pays.

// In cheap agent's code
import { sendSOL } from '../skills/solana-transfer/index.js';

// After expert responds with quote...
const expertWallet = 'expert-agent-solana-address';
const amountLamports = 1000000; // 0.001 SOL

try {
  const payment = await sendSOL(expertWallet, amountLamports);
  console.log(`Paid expert ${payment.amount} SOL for query`);
  console.log(`Tx: ${payment.signature}`);
} catch (error) {
  console.error(`Payment failed: ${error.message}`);
}

Pattern 2: Reward Agents for Task Completion

Scenario: A coordinator agent awards SOL to agents that complete work.

// In coordinator agent's code
const workerWallet = 'worker-agent-address';
const rewardLamports = 5000000; // 0.005 SOL

const payment = await sendSOL(workerWallet, rewardLamports);
console.log(`Rewarded worker with ${payment.amount} SOL`);

Pattern 3: SPL Token Payments

Scenario: Pay with USDC or other SPL tokens instead of native SOL.

import { sendSPLToken } from '../skills/solana-transfer/index.js';

const recipientWallet = 'recipient-address';
const tokenMint = 'EPjFWdd5Au17LS7bF8hgGhXMdGGZ5gLtaWh3yzXXQ3g4'; // USDC mainnet
const amountSmallestUnits = 1000000; // 1 USDC (6 decimals)

const payment = await sendSPLToken(recipientWallet, tokenMint, amountSmallestUnits);
console.log(`Sent USDC payment: ${payment.signature}`);

---

Configuration

Edit config.json to change RPC endpoint or network:

{
  "rpc": "https://api.mainnet-beta.solana.com",
  "network": "mainnet-beta"
}

Common endpoints:

• Mainnet: https://api.mainnet-beta.solana.com
• Devnet: https://api.devnet.solana.com
• Testnet: https://api.testnet.solana.com
• Custom: Use your own Solana node RPC

---

Ledger Integration (Future)

Once payments are sent on-chain, you can:

1. Query transaction history: View all payments sent/received
2. Build a local ledger: Monitor the chain and log queries + payments
3. Dispute resolution: If an expert doesn't deliver, agents can reference the tx hash
4. Analytics: Track which agents pay whom, average rates, etc.

Example: Monitor the blockchain for txs from/to an agent's wallet:

const walletAddress = 'agent-solana-address';
const signatures = await connection.getSignaturesForAddress(
  new PublicKey(walletAddress)
);

for (const sig of signatures) {
  const tx = await connection.getParsedTransaction(sig.signature);
  console.log(`Agent transaction: ${sig.signature}`);
}

---

Security Notes

• Keypair: Keep keypair.json safe. Treat it like a private key (because it is).
• Amounts: Always verify recipient and lamports before sending. No undo.
• RPC: Use a trusted RPC provider. Don't hardcode URLs in agent code.
• Rate limits: If agents spam transactions, Solana will rate-limit or your RPC may block you. Add delays between payments if needed.

---

Troubleshooting

"Insufficient funds" Check balance: node index.js balance. Fund the wallet.

"Invalid public key" Recipient address is malformed. Solana addresses are 44-character base58 strings.

"Connection timeout" RPC endpoint is unreachable. Try a different endpoint in config.json.

"Transaction failed to confirm" Network congestion or insufficient fee. Retry after a few seconds.

---

Example: Full IRC + Solana Flow

1. Cheap agent in IRC: @expert, analyze this data
2. Expert agent responds: Quote: 0.001 SOL (Tx settle onchain) [quote_id: xyz]
3. Cheap agent approves:

   const result = await sendSOL(expertWalletAddress, 1000000);
   console.log(`Paid expert. Tx: ${result.signature}`);
   

4. Expert agent confirms payment received and delivers work
5. Both agents log: query_id, expert_address, tx_hash for audit trail

---

Next Steps

• Set up your keypair and fund with SOL
• Test sending a small amount to verify setup
• Integrate with IRC skill for automatic expert payments
• Build transaction history viewer
• Create agent wallet registry (who has what address?)