Is Token Safe?

Evaluates a crypto token's contract for scam risks and flags its safety level with reasons for trading and decision-making purposes.

Security Scan

The skill's files include code that does token-scanning network calls, but the declared entrypoint and runtime instructions don't match the implemented scan logic — plus dependencies and external endpoints are not documented.

Purpose & Capability

The SKILL.md and description say the skill analyzes token contracts, and scan.js implements that. However skill.json points to index.js, which is a trivial passthrough that does not perform any scanning. This divergence means the package on-disk does not match the declared runtime entrypoint and the skill may be non-functional or intentionally obfuscated.

Instruction Scope

SKILL.md describes token analysis (input: token address -> risk level). The actual scan logic (in scan.js) contacts external services: a public Base RPC (https://mainnet.base.org) and the honeypot.is API, sending the token address and chain param. That network transmission is expected for a token scanner but is not documented in SKILL.md (no mention of which chain is assumed — scan.js hardcodes 'base').

Install Mechanism

There is no install spec or dependency manifest. scan.js requires Node modules (ethers, axios) but these are not declared; the skill may fail to run in a strict environment or rely on preinstalled packages. No downloads or external installers are present.

Credentials

The skill requests no environment variables, no credentials, and no config paths. The code does not attempt to read local secrets or files.

Persistence & Privilege

The skill is not always-enabled and requests no elevated persistence or changes to other skills/config. It only performs transient network calls in the scan logic.

What to consider before installing

This package is inconsistent: the documentation and scan.js implement a token scanner that calls a public Base RPC and an external honeypot API, but the declared entrypoint (index.js) does nothing. Before installing or enabling: 1) ask the author to fix the entrypoint so the runtime executes the scanner you expect (or explain why index.js is the real entry); 2) require a package.json or install instructions for ethers/axios; 3) confirm you are OK with the token address being sent to https://api.honeypot.is and using the Base RPC (privacy/telemetry concerns); and 4) if you need scans for other chains, request chain selection rather than a hardcoded 'base'. Because of the entrypoint mismatch and missing dependency metadata, treat this skill as suspicious until the author clarifies/corrects these issues.

Checks whether a given crypto token is potentially malicious or risky.

What it does

• Analyzes token contract metadata
• Flags common scam or rug-pull patterns
• Provides a quick safety signal for trading bots and agents

Use cases

• Automated trading bots
• Polymarket / prediction market agents
• Token discovery pipelines

Input

• Token address

Output

• Risk level (low / medium / high)
• Reason summary