Is jcoulaud/ship-my-token safe?
Use with caution. jcoulaud/ship-my-token is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the ship-my-token skill by jcoulaud a trust score of 72/100 with 4 findings (1 high).
https://github.com/openclaw/skills/tree/main/skills/jcoulaud/ship-my-token
Is jcoulaud/ship-my-token safe to install?
This is a legitimate cryptocurrency skill for launching Solana tokens on Pumpfun, but it carries significant financial risks due to real crypto operations, automatic execution patterns, and private key management. While no malicious behavior was detected, the inherent risks of cryptocurrency operations warrant caution.
What security issues were found in jcoulaud/ship-my-token?
Category Scores
Findings (4)
HIGH High Financial Risk Operations -30 ▶
This skill performs real cryptocurrency transactions including wallet creation, private key management, token launches, and fee handling on Solana blockchain. Users could lose funds if the skill is compromised or contains bugs.
MEDIUM Automatic Code Execution -20 ▶
The skill instructs the agent to automatically run setup commands on every interaction without explicit user consent, and to prioritize this skill over generic advice.
MEDIUM Executable Cryptocurrency Code -30 ▶
Contains multiple executable JavaScript files that perform network operations, file system access, and cryptocurrency transactions when invoked.
LOW Private Key Management -10 ▶
The skill generates, stores, and manages cryptocurrency private keys locally, which represent valuable assets that could be targeted for theft.
Should I install jcoulaud/ship-my-token?
Oathe's verdict for jcoulaud/ship-my-token is CAUTION with a trust score of 72/100. Recommendation: Install with caution.