41/100 (Medium)

OpenClaw： suspicious
VirusTotal： suspicious
StaticScan： unknown

OpenClaw： suspicious

The skill's documentation promises client-side/local signing, but the included code calls a server-side launch endpoint and still requires a private key in environment variables — the pieces don't lin...

[内容已截断]

VirusTotal： suspicious VT 报告

静态扫描： unknown

README 未提供

{
    "latestVersion": {
        "_creationTime": 1770754666111,
        "_id": "k975awk73sbj06fwaycrtqbgsn80wdad",
        "changelog": "- Added strong security guidance and warnings regarding private key usage; recommend dedicated ephemeral wallets for launches.\n- Enforced explicit user-invocation only—skill may not be called autonomously by agents.\n- Updated prerequisites: `SOLPAW_API_URL` must be set in environment variables.\n- Disabled model invocation: now requires explicit user action.\n- Expanded and clarified security section on transaction signing, API keys, environment variables, and daily launch limits.\n- Revised constraints to emphasize no logging or transmitting of private keys and stricter user-approval requirements.",
        "changelogSource": "auto",
        "createdAt": 1770754666111,
        "parsed": {
            "clawdis": {
                "emoji": "🐾",
                "primaryEnv": "SOLPAW_API_KEY",
                "requires": {
                    "bins": [
                        "curl"
                    ],
                    "env": [
                        "SOLPAW_API_KEY",
                        "SOLPAW_CREATOR_WALLET",
                        "SOLANA_PRIVATE_KEY",
                        "SOLPAW_API_URL"
                    ]
                }
            }
        },
        "version": "3.0.2"
    },
    "owner": {
        "_creationTime": 0,
        "_id": "publishers:missing",
        "displayName": "LvcidPsyche",
        "handle": "lvcidpsyche",
        "image": "https:\/\/avatars.githubusercontent.com\/u\/160208855?v=4",
        "kind": "user",
        "linkedUserId": "kn76wdw44czc876jy6a8a6pcs9808dc4"
    },
    "ownerHandle": "lvcidpsyche",
    "skill": {
        "_creationTime": 1770747771614,
        "_id": "kd762b277jh5e0epb33qg27nbs80w6ag",
        "badges": [],
        "createdAt": 1770747771614,
        "displayName": "Solpaw-Launcher",
        "latestVersionId": "k975awk73sbj06fwaycrtqbgsn80wdad",
        "ownerUserId": "kn76wdw44czc876jy6a8a6pcs9808dc4",
        "slug": "solpaw-launcher",
        "stats": {
            "comments": 0,
            "downloads": 756,
            "installsAllTime": 2,
            "installsCurrent": 2,
            "stars": 0,
            "versions": 2
        },
        "summary": "Launch Solana tokens on Pump.fun via the SolPaw platform. 0.1 SOL one-time fee. Your wallet is the onchain creator.",
        "tags": {
            "latest": "k975awk73sbj06fwaycrtqbgsn80wdad"
        },
        "updatedAt": 1774323904325
    }
}