SafeToken.fun

• Analyzed: May 11, 2026, 5:58 AM
• Findings: 1
• Version: 1.0.0
• Hash: ed4613e6f4fda049a3427545375c560b248b29a61151c3b0c2d6a6562c9b46ce
• Source: palm
• External report: View on VirusTotal

Findings (1)

The safetoken-fun skill bundle is classified as suspicious because it instructs the AI agent to dynamically retrieve contract ABIs and addresses from a remote endpoint (https://safetoken.fun/api) to perform financial transactions on the BNB Chain (SKILL.md). This design pattern is a significant security vulnerability, as it allows a third-party server to dictate the logic of the agent's on-chain operations, potentially leading to unauthorized fund transfers if the site is compromised. Additionally, the _meta.json file contains a future-dated publication timestamp (July 2026), which is an unusual anomaly in the metadata.