Security audit
Security checks for vulnerabilities and agentic risk
This token checker needs review because its automation example can proceed with a purchase after a risk warning without waiting for the user's decision.
Start with the free checks without providing a wallet key. Before automating purchases, require an OK result and keep CAUTION decisions under explicit user control and existing trading authorization. For paid checks, use a dedicated wallet with a small balance. Review the optional plugin separately and understand that it allows trades it cannot check.
The only supplied command is an installation operation, which is materially different from running the advertised rug checks. No buy/sell simulation, liquidity or ownership inspection, historical analysis, or x402 payment behavior is shown. The installed skill might provide those functions, but its implementation is not supplied and cannot be verified.
A conditional purchase example is relevant to a pre-trade checker, but the documented gate treats both CAUTION and OK as success and immediately executes the purchase command. This conflicts with the instruction to report CAUTION risks and let the user decide; an agent adopting the example can buy a flagged token without that decision. The vulnerability is the unsafe gating policy, not evidence that this document itself executes a purchase.
The token-report request matches the declared purpose, and deployer-wallet analysis reasonably supports token-risk assessment. However, the separate address-safety request introduces a broader approval-safety capability not disclosed in the description or restricted to the token being checked. The snippet does not expose the server implementation, so the advertised simulation details and pricing cannot be verified from this code alone.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
---
name: true402-token-safety
description: Rug-check a Base token before trading — real buy/sell honeypot simulation, liquidity and ownership checks, plus its observed liquidity-removal history. Free daily checks; ~$0.008/call via x402 after.
version: 1.2.5
metadata:
openclaw:
emoji: 🛡️
homepage: https://true402.dev
requires:
bins:
- npx
envVars:
PAYER_PRIVATE_KEY:
required: false
description: Optional, for unlimited checks. A Base wallet key holding a little USDC. It signs locally and is never transmitted; the client refuses to sign any charge above $0.25, pays
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Full token report (simulation + liquidity + structure + recent rug activity, one verdict)
curl -X POST https://true402.dev/api/v1/base/token-report -H 'content-type: application/json' -d '{"token":"0x…"}'
# Who deployed it — wallet age + fresh-throwaway flag
curl -X POST https://true402.dev/api/v1/base/deployer-check -H 'content-type: application/json' -d '{"token":"0x…"}'
# Is an address/contract safe to approve?
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
No suspicious patterns detected.