Caveat verdict
solpaw
solpaw-skill
Accesses credentials AND makes external network calls
Token launch platform using the agents Solana private key to sign real blockchain transactions including a mandatory 0.1 SOL platform fee payment per launch.
Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
What it does
These are capability combinations: each listed behavior occurs in the skill, but Caveat detects co-occurrence — it does not verify that one flows into another. Read the code to confirm a live chain.
Accesses credentials AND makes external network calls — potential credential theft
LLM02 · ASI03
Accesses credentials AND encodes data — may obfuscate stolen credentials
LLM02 · ASI03 · ASI04
Findings (5)
Possible hardcoded credential
README.md · code · API_KEY="sk-solpaw-your-api-key
Accesses process.env — reads environment variables
SKILL.md · code
Accesses sensitive environment variables
SKILL.md · code · process.env.SOLPAW_API_KEY
Base64 encoding/decoding
references/api-docs.md · code · base64-encode
References agent configuration files
README.md · prose · downgraded · agent-config
Permissions & capabilities
Requires 3 environment variables. (2 sensitive: SOLPAW_API_KEY, SOLANA_PRIVATE_KEY). Requires 1 system binary. (1 elevated: curl).
network_outcredential_accessdata_encodingnetwork_in Thanks — recorded.