The code and runtime instructions match a live Solana trading bot (which legitimately requires wallet keys and RPC/API keys), but the skill metadata claims no required credentials or install steps — this mismatch plus the need to supply a private key is a meaningful security/configuration concern you should address before running live.
评估建议
This bundle is a coherent Solana trading bot and WILL need sensitive credentials to run live (a private key capable of signing transactions, Solana RPC URL, Helius and Jupiter API keys, and optionally an X/Twitter Bearer token). Before you run it: (1) Treat it as high-risk — do NOT put a main wallet private key here. Use an isolated test wallet with only a small amount of funds if you want to experiment. (2) Prefer paper mode for initial testing (no live transactions). (3) Review the code paths ...
详细分析 ▾
⚠用途与能力
The skill is a full-featured Solana trading bot (copy-trading, live swaps, RPC queries, X stream). That purpose legitimately requires SOLANA_RPC_URL, HELIUS_API_KEY, JUP_API_KEY and a WALLET_PRIVATE_KEY to perform live trades — but the registry metadata lists no required environment variables or primary credential. The metadata therefore underreports the skill's privileges and needed secrets.
ℹ指令范围
SKILL.md and docs explicitly instruct how to run in paper or live mode and to place API keys and a wallet private key in .env. The runtime instructions (and the code) will: read local config files, poll external services (DexScreener, Jupiter, Helius, Solana RPC, X/Twitter), and sign/send transactions when in live mode. All of that is consistent with the described trading purpose; there is no obvious out-of-scope file-reading or hidden exfiltration to unexpected endpoints.
ℹ安装机制
No install spec was provided in the registry, but the bundle contains a full Node/TypeScript project and package.json. Running it requires npm install / tsx (dependencies are normal for Solana tooling). The mismatch (registry says instruction-only while code files exist) is an integrity/packaging concern but not an outright malicious install mechanism.
⚠凭证需求
Live operation requires high‑privilege secrets: WALLET_PRIVATE_KEY_BASE58 or WALLET_PRIVATE_KEY_JSON (used to sign and send transactions), SOLANA_RPC_URL (node access), HELIUS_API_KEY (wallet event streaming), JUP_API_KEY (Jupiter), and optionally X_BEARER_TOKEN. These are proportionate to a live trading bot, but the registry metadata omitted declaring any required envs/primary credential — that omission increases risk because users may not realize they must supply a private key. Supplying a private key gives the skill full control over funds in that wallet.
✓持久化与权限
The skill does not request always:true, does not modify other skills, and does not persist tokens into other skills. It reads local config files and may write nothing persistent; autonomy (agent-invocation) is allowed by default but is not unusual for skills. No system-wide privilege escalation was observed.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/2
Solana Memecoin Guardian v2
Solana Memecoin Guardian v2 is an autonomous trading skill designed to discover and trade Solana memecoins while minimizing downside risk. The system combines multiple intelligence layers, including smart-wallet copy trading, AI-driven market analysis, on-chain risk validation, and social narrative detection.
The engine continuously monitors the Solana ecosystem through sources such as Pump.fun, DexScreener, and on-chain wallet activity. It selectively follows high-performing smart wallets while also generating independent trade signals using rule-based AI analysis of liquidity stability, transaction flow, volatility patterns, and market structure.
In addition to market data, the system integrates a Narrative Engine that monitors viral trends and influential posts on platforms such as X (Twitter). When strong narratives emerge, the engine identifies relevant tokens and boosts them as potential candidates for analysis. However, narrative signals alone never trigger trades; every opportunity must still pass strict on-chain safety checks.
A unified Risk Gate protects the strategy from common memecoin threats such as rug pulls, excessive holder concentration, unstable liquidity, or abnormal trading behavior. Position sizing, portfolio exposure, and daily loss limits are strictly controlled to ensure capital preservation.
The architecture includes several core components:
• Smart Wallet Copy-Trade Engine
• AI Analysis Engine
• Narrative Detection Engine (X / social signals)
• Shared Risk Gate and On-Chain Safety Checks
• Position Manager with TP/SL and Trailing Stops
• Rug Alarm System for emergency exits
• Risk Budget Orchestrator for capital protection
By combining on-chain intelligence, social trend awareness, and strict risk management, Solana Memecoin Guardian v2 aims to capture high-probability opportunities while avoiding the majority of unsafe or manipulative tokens.
Primary philosophy:
Missing 100 pumps is acceptable.
Surviving one rug is mandatory.
by