openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-22 03:35:29 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

False positive: whistle-rpc flagged as suspicious - legitimate Solana RPC infrastructure skill #162

New Issue
Open
opened 2026-02-15 17:15:58 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:15:58 -05:00
Owner
Copy Link
Copy Source

Originally created by @DylanPort on GitHub (Feb 13, 2026).

Skill

What happened

After publishing whistle-rpc, it was flagged as suspicious with the message:

Skill flagged — suspicious patterns detected

Why the flag is a false positive

Whistle RPC is a production Solana RPC infrastructure service built for AI agents. The patterns the scanner flagged are the actual product — not phishing or scam content:

1. External URLs (the service endpoints)

The skill documents real API endpoints that agents connect to:

  • https://rpc.whistle.ninja — Solana JSON-RPC 2.0 endpoint
  • wss://rpc.whistle.ninja/ws — WebSocket subscriptions
  • https://dex.whistle.ninja/v1 — DEX/market data API
  • https://api.whistle.ninja — Agent subscription API

These are the core product. An RPC skill without endpoint URLs would be useless. The domain whistle.ninja has been live and serving Solana RPC traffic. You can verify it's a real service:

curl -s -X POST https://rpc.whistle.ninja -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","id":1,"method":"getHealth"}'

2. Payment instructions (SOL transfer for subscription)

The skill describes a 1 SOL/month subscription paid on-chain via standard SystemProgram.transfer. This is the x402-style payment model — agents pay programmatically, no browser or signup required. The code example shows a standard Solana transaction, not a drain or exploit:

SystemProgram.transfer({
    fromPubkey: keypair.publicKey,
    toPubkey: new PublicKey(quote.recipient),
    lamports: quote.amount * LAMPORTS_PER_SOL
})

The recipient address comes from the /api/agent/subscribe quote endpoint (not hardcoded), and the amount is exactly 1 SOL as documented.

3. fetch() calls to external services

The code examples show fetch() calls to api.whistle.ninja — this is the subscription API. It's no different from any skill that documents how to call an external API (e.g., OpenAI, Stripe, Supabase). The full subscribe -> pay -> activate flow is documented transparently.

4. NPM package (npx whistle-rpc)

The skill references a CLI tool published on npm. This is the one-command entry point for agents — it's how the service is consumed.

Verification

  • Website: https://whistle.ninja (live dashboard, public)
  • NPM: https://npmjs.com/package/whistle-rpc (published package)
  • GitHub history: The skill was published by @DylanPort, the operator of Whistle's Solana cache node infrastructure
  • On-chain presence: Whistle has an active Solana program and staking/bonding economy

Request

Please review and remove the suspicious flag. This is a legitimate infrastructure service skill. Happy to provide any additional verification needed.

Originally created by @DylanPort on GitHub (Feb 13, 2026). ## Skill - **Name:** whistle-rpc - **Slug:** `whistle-rpc` - **Version:** 1.0.0 - **Owner:** @DylanPort - **URL:** https://clawhub.ai/skills/whistle-rpc ## What happened After publishing `whistle-rpc`, it was flagged as suspicious with the message: > Skill flagged — suspicious patterns detected ## Why the flag is a false positive Whistle RPC is a **production Solana RPC infrastructure service** built for AI agents. The patterns the scanner flagged are the actual product — not phishing or scam content: ### 1. External URLs (the service endpoints) The skill documents real API endpoints that agents connect to: - `https://rpc.whistle.ninja` — Solana JSON-RPC 2.0 endpoint - `wss://rpc.whistle.ninja/ws` — WebSocket subscriptions - `https://dex.whistle.ninja/v1` — DEX/market data API - `https://api.whistle.ninja` — Agent subscription API These are the **core product**. An RPC skill without endpoint URLs would be useless. The domain `whistle.ninja` has been live and serving Solana RPC traffic. You can verify it's a real service: ```bash curl -s -X POST https://rpc.whistle.ninja -H "Content-Type: application/json" -d '{"jsonrpc":"2.0","id":1,"method":"getHealth"}' ``` ### 2. Payment instructions (SOL transfer for subscription) The skill describes a **1 SOL/month subscription** paid on-chain via standard `SystemProgram.transfer`. This is the x402-style payment model — agents pay programmatically, no browser or signup required. The code example shows a standard Solana transaction, not a drain or exploit: ```javascript SystemProgram.transfer({ fromPubkey: keypair.publicKey, toPubkey: new PublicKey(quote.recipient), lamports: quote.amount * LAMPORTS_PER_SOL }) ``` The recipient address comes from the `/api/agent/subscribe` quote endpoint (not hardcoded), and the amount is exactly 1 SOL as documented. ### 3. `fetch()` calls to external services The code examples show `fetch()` calls to `api.whistle.ninja` — this is the subscription API. It's no different from any skill that documents how to call an external API (e.g., OpenAI, Stripe, Supabase). The full subscribe -> pay -> activate flow is documented transparently. ### 4. NPM package (`npx whistle-rpc`) The skill references a CLI tool published on npm. This is the one-command entry point for agents — it's how the service is consumed. ## Verification - **Website:** https://whistle.ninja (live dashboard, public) - **NPM:** https://npmjs.com/package/whistle-rpc (published package) - **GitHub history:** The skill was published by @DylanPort, the operator of Whistle's Solana cache node infrastructure - **On-chain presence:** Whistle has an active Solana program and staking/bonding economy ## Request Please review and remove the suspicious flag. This is a legitimate infrastructure service skill. Happy to provide any additional verification needed.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#162
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?