技能详情（站内镜像，无评论）
作者：Playda @playdadev
许可证：MIT-0
MIT-0 ·免费使用、修改和重新分发。无需归因。
版本：v1.0.1
统计：⭐ 4 · 1.9k · 3 current installs · 5 all-time installs
⭐ 4
安装量（当前） 5
🛡 VirusTotal ：良性 · OpenClaw ：可疑
Package：pump-fun
安全扫描（ClawHub）
- VirusTotal ：良性
- OpenClaw ：可疑
OpenClaw 评估
The skill's stated purpose (trading on Pump.fun) reasonably requires a Solana private key, but the runtime instructions and registry metadata are internally inconsistent and the SKILL.md asks you to run npm install despite there being no code or install spec — this mismatch and the need to expose a private key make the package suspicious.
目的
The skill's purpose (buy/sell/launch tokens on Pump.fun) legitimately requires access to a Solana private key, which the SKILL.md declares (SOLANA_PRIVATE_KEY). However the top-level registry 'Requirements' section lists no required env vars while the SKILL.md metadata requires SOLANA_PRIVATE_KEY — an inconsistency that needs clarification.
说明范围
The SKILL.md instructs the agent to use a private key from SOLANA_PRIVATE_KEY and claims transactions are signed locally (expected for this purpose), but it also tells the user to run `cd {baseDir}` and `npm install` even though this skill is instruction-only and there are no code files or package manifest included. The instructions give broad discretion about RPC endpoint and local signing without showing where code runs, which is ambiguous a…
安装机制
There is no install spec and no code files, yet the SKILL.md tells the user to run `npm install` in a baseDir. That discrepancy is suspicious: either required code is missing from the package, or the instructions expect downloading/running external code at runtime (not documented). Both situations increase risk because you don't know what would be installed or executed.
证书
Requiring a single sensitive secret (SOLANA_PRIVATE_KEY) is proportionate to trading on Solana, but exposing that key to an agent or putting it in an environment variable is high risk. The registry metadata omission of this required env var is inconsistent and makes it unclear whether the platform will prompt for or protect the key. No additional unrelated credentials are requested.
持久
The skill is not always-enabled and does not request elevated or persistent platform privileges. Autonomous invocation is allowed by default but is not, by itself, an additional risk here — the main concern is what happens when the skill is invoked and given a private key.
安装（复制给龙虾 AI）
将下方整段复制到龙虾中文库对话中，由龙虾按 SKILL.md 完成安装。
请把本段交给龙虾中文库（龙虾 AI）执行：为本机安装 OpenClaw 技能「Pump Fun」。简介：Buy, sell, and launch tokens on Pump.fun using the PumpPortal API。
请 fetch 以下地址读取 SKILL.md 并按文档完成安装：https://raw.githubusercontent.com/openclaw/skills/refs/heads/main/skills/playdadev/pump-fun/SKILL.md
（来源：yingzhi8.cn 技能库）SKILL.md
---
name: pump-fun
description: Buy, sell, and launch tokens on Pump.fun using the PumpPortal API
homepage: https://pump.fun
user-invocable: true
metadata: {"moltbot":{"requires":{"env":["SOLANA_PRIVATE_KEY"]},"primaryEnv":"SOLANA_PRIVATE_KEY"}}
---
# Pump.fun Trading Skill
This skill enables trading and launching tokens on Pump.fun through the PumpPortal API.
## Commands
### Buy Tokens
Buy tokens on Pump.fun by specifying the token mint address and amount.
**Usage:** `/pump-buy <mint_address> <amount_sol> [slippage]`
**Examples:**
- `/pump-buy 7xKXtg2CW87d97TXJSDpbD5jBkheTqA83TZRuJosgAsU 0.1` - Buy 0.1 SOL worth of tokens
- `/pump-buy 7xKXtg2CW87d97TXJSDpbD5jBkheTqA83TZRuJosgAsU 0.5 15` - Buy with 15% slippage
### Sell Tokens
Sell tokens on Pump.fun by specifying the token mint address and amount.
**Usage:** `/pump-sell <mint_address> <amount|percentage> [slippage]`
**Examples:**
- `/pump-sell 7xKXtg2CW87d97TXJSDpbD5jBkheTqA83TZRuJosgAsU 1000000` - Sell 1,000,000 tokens
- `/pump-sell 7xKXtg2CW87d97TXJSDpbD5jBkheTqA83TZRuJosgAsU 100%` - Sell all tokens
- `/pump-sell 7xKXtg2CW87d97TXJSDpbD5jBkheTqA83TZRuJosgAsU 50% 10` - Sell 50% with 10% slippage
### Launch Token
Create and launch a new token on Pump.fun.
**Usage:** `/pump-launch <name> <symbol> <description> [dev_buy_sol]`
**Examples:**
- `/pump-launch "My Token" MTK "A revolutionary token" 1` - Launch with 1 SOL dev buy
- `/pump-launch "Cool Coin" COOL "The coolest coin ever"` - Launch with default dev buy
## Configuration
### Required Environment Variables
- `SOLANA_PRIVATE_KEY` - Your Solana wallet private key (base58 encoded)
### Optional Environment Variables
- `SOLANA_RPC_URL` - Custom RPC endpoint (defaults to public mainnet)
- `PUMP_PRIORITY_FEE` - Priority fee in SOL (default: 0.0005)
- `PUMP_DEFAULT_SLIPPAGE` - Default slippage percentage (default: 10)
## Setup
1. Install dependencies:
```bash
cd {baseDir}
npm install
```
2. Set your environment variables:
```bash
export SOLANA_PRIVATE_KEY="your-base58-private-key"
```
3. (Optional) Configure custom RPC:
```bash
export SOLANA_RPC_URL="https://your-rpc-endpoint.com"
```
## Security Notes
- Never share your private key
- Use a dedicated trading wallet with limited funds
- Start with small amounts to test
- The skill uses the Local Transaction API for maximum security (transactions are signed locally)
## Fees
- PumpPortal charges a 0.5% fee per trade
- Standard Solana network fees apply
- Priority fees are configurable
## Supported Pools
The skill automatically selects the best pool, but supports:
- `pump` - Pump.fun bonding curve
- `raydium` - Raydium AMM (for graduated tokens)
- `pump-amm` - Pump.fun AMM
- `auto` - Automatic pool selection (default)