Rugpull
Security checks across malware telemetry and agentic risk
Overview
This appears to be a benign local entry-management helper, but it does not really provide the advertised blockchain rugpull analysis and it stores user-entered data under the user's home directory.
This is safe to use as a simple local entry tracker, but do not treat it as a real blockchain rugpull-analysis engine based on these artifacts alone. Avoid adding secrets, remember that entries persist in ~/.rugpull by default, and approve remove/export commands only when you intend those local data changes.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user may expect protocol-security analysis when the artifacts mainly provide a local note/list tool.
The advertised purpose suggests blockchain/security analysis, but the documented functionality is generic local entry management. This is not malicious, but users should not over-trust it as an automated rugpull analyzer.
description: "Analyze rugpull operations. Use when you need to understand rugpull mechanisms, evaluate protocol security, or reference on-chain concepts." ... "add": Add new entry ... "list": List all entries ... "export": Export data to file
Use it only as a local tracking/reference helper unless additional reviewed artifacts provide actual rugpull analysis logic.
If invoked unintentionally, the agent could remove stored entries or create an export file from the skill's local data.
The helper can delete entries from its own data file and export stored data to a file. These actions are scoped and documented, but they are still local mutations that should match the user's request.
cmd_remove() { ... sed -i "${num}d" "$DATA_DIR/data.jsonl" ... } ... cmd_export() { ... cp "$DATA_DIR/data.jsonl" "$out" ... }Review agent requests to run remove or export commands, and keep the data directory scoped to non-sensitive skill data.
Information entered into the skill persists across sessions and may be surfaced later by list/search/export commands.
User-provided entries are stored persistently in a local JSONL file under ~/.rugpull by default and can later be listed, searched, or exported.
DATA_DIR="${RUGPULL_DIR:-$HOME/.rugpull}" ... printf '{"ts":"%s","cmd":"%s","val":"%s"}\n' "$ts" "$cmd" "$val" >> "$DATA_DIR/data.jsonl"Avoid storing secrets or sensitive investigation details unless you are comfortable keeping them in ~/.rugpull, or set RUGPULL_DIR to a controlled location and delete data when no longer needed.