Token Security

Name: Token Security
Author: alsk1992

alsk1992/cloddsbot

13 installs
610 repo stars
Updated June 26, 2026
alsk1992/cloddsbot

token-security is a skill that audits a crypto token address for honeypot, rug-pull, and risk using the GoPlus API.

About

This skill audits the security of a crypto token address using the GoPlus API. It performs honeypot detection, rug-pull analysis, and risk scoring, and can auto-detect the chain or run against a named chain. A trader uses it to check whether a token is safe before buying.

Token security audit via the GoPlus API
Honeypot detection, rug-pull analysis, and risk scoring
Auto-detects chain or audits on a specified chain from a token address

Token Security by the numbers

13 all-time installs (skills.sh)
Ranked #1,634 of 2,203 Security skills by installs in the Skillselion catalog
Data as of Aug 5, 2026 (Skillselion catalog sync)

At a glance

token-security capabilities & compatibility

Uses the GoPlus API; GoPlus offers free token-security endpoints.

Capabilities: honeypot detection · rug pull analysis · risk scoring
Use cases: security audit
Runs: Runs locally
Pricing: Bring your own API key

From the docs

What token-security says it does

Comprehensive token security analysis powered by GoPlus API - honeypot detection, rug-pull analysis, and risk scoring.

SKILL.md

/audit <address> Auto-detect chain and audit token

SKILL.md

npx skills add https://github.com/alsk1992/cloddsbot --skill token-security

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

[![Listed on Skillselion](https://skillselion.com/badge/skills/alsk1992/cloddsbot/token-security.svg)](https://skillselion.com/skills/alsk1992/cloddsbot/token-security)

Installs	13
repo stars	★ 610
Last updated	June 26, 2026
Repository	alsk1992/cloddsbot ↗

What it does

Audit a token address for honeypot, rug-pull, and risk before trading it.

Who is it for?

Screening a crypto token contract for scam risk before buying.

Skip if: Auditing application source code or web app vulnerabilities.

When should I use this skill?

You have a token address and need a honeypot or rug-pull risk check before trading.

What you get

A token risk assessment covering honeypot status and rug-pull indicators.

Token risk report
Honeypot and rug-pull assessment

By the numbers

3 audit commands documented

Files

SKILL.mdMarkdownGitHub ↗

Token Security Audit

Comprehensive token security analysis powered by GoPlus API - honeypot detection, rug-pull analysis, and risk scoring.

Commands

/audit <address>                  Auto-detect chain and audit token
/audit <address> --chain <name>   Audit token on specific chain
/audit help                       Show help

/**
 * Token Security Audit Skill
 *
 * Commands:
 * /audit <address>              — Auto-detect chain, full security audit
 * /audit <address> --chain eth  — Specify chain explicitly
 * /audit help                   — Show usage
 */

const HELP = `Token Security Audit — GoPlus-powered risk scanner

Usage:
  /audit <address>                  Auto-detect chain (EVM or Solana)
  /audit <address> --chain <name>   Specify chain (eth, bsc, polygon, arb, base, solana...)
  /audit help                       Show this help

Chains: ethereum, bsc, polygon, arbitrum, optimism, avalanche, fantom, base, linea, scroll, zksync, mantle, blast, solana

Examples:
  /audit So11111111111111111111111111111111
  /audit 0xdAC17F958D2ee523a2206206994597C13D831ec7 --chain eth
  /audit 0x...abc --chain base`;

function detectChain(address: string): string {
  if (address.startsWith('0x') && address.length === 42) return 'ethereum';
  if (!address.startsWith('0x') && address.length >= 32 && address.length <= 44) return 'solana';
  return 'ethereum';
}

function riskBar(score: number): string {
  const filled = Math.round(score / 10);
  const empty = 10 - filled;
  return '[' + '#'.repeat(filled) + '-'.repeat(empty) + ']';
}

function formatResult(r: any): string {
  const lines: string[] = [];
  lines.push(`Token Security Audit`);
  lines.push('='.repeat(40));
  if (r.name || r.symbol) {
    lines.push(`Token: ${r.name || '?'} (${r.symbol || '?'})`);
  }
  lines.push(`Address: ${r.address}`);
  lines.push(`Chain: ${r.chain}`);
  lines.push('');
  lines.push(`Risk Score: ${r.riskScore}/100 ${riskBar(r.riskScore)} ${r.riskLevel.toUpperCase()}`);
  lines.push('');

  lines.push('Security Checks:');
  lines.push(`  Honeypot:       ${r.isHoneypot ? 'YES' : 'No'}`);
  lines.push(`  Open Source:    ${r.isOpenSource ? 'Yes' : 'NO'}`);
  lines.push(`  Proxy Contract: ${r.hasProxyContract ? 'YES' : 'No'}`);
  lines.push(`  Mint Function:  ${r.hasMintFunction ? 'YES' : 'No'}`);
  lines.push(`  Blacklist:      ${r.hasBlacklist ? 'YES' : 'No'}`);
  lines.push('');

  if (r.buyTax > 0 || r.sellTax > 0) {
    lines.push('Tax:');
    lines.push(`  Buy Tax:  ${r.buyTax.toFixed(1)}%`);
    lines.push(`  Sell Tax: ${r.sellTax.toFixed(1)}%`);
    lines.push('');
  }

  lines.push('Holders:');
  lines.push(`  Total Holders:    ${r.holderCount.toLocaleString()}`);
  lines.push(`  Top 10 Own:       ${r.top10HolderPct.toFixed(1)}%`);
  lines.push(`  Creator Holds:    ${r.creatorHolderPct.toFixed(1)}%`);
  lines.push('');

  lines.push('Liquidity:');
  lines.push(`  Total:  $${r.totalLiquidity.toLocaleString()}`);
  lines.push(`  Locked: ${r.liquidityLocked ? 'Yes' : 'No'}`);

  if (r.riskFlags.length > 0) {
    lines.push('');
    lines.push('Risk Flags:');
    for (const flag of r.riskFlags) {
      lines.push(`  - ${flag}`);
    }
  }

  return lines.join('\n');
}

export default {
  name: 'token-security',
  description: 'Token security audit via GoPlus API — honeypot detection, rug-pull analysis, risk scoring',
  commands: [
    { name: 'audit', description: 'Audit a token for security risks', usage: '/audit <address> [--chain <name>]' },
  ],
  async handle(args: string): Promise<string> {
    const trimmed = args.trim();
    if (!trimmed || trimmed === 'help') return HELP;

    try {
      const { createTokenSecurityService } = await import('../../../token-security/index.js');
      const service = createTokenSecurityService();

      // Parse --chain flag
      const chainMatch = trimmed.match(/--chain\s+(\S+)/i);
      const address = trimmed.replace(/--chain\s+\S+/i, '').trim();

      if (!address) return 'Please provide a token address. Run /audit help for usage.';

      const chain = chainMatch?.[1] || detectChain(address);
      const result = await service.auditToken(address, chain);
      return formatResult(result);
    } catch (err: any) {
      return `Audit failed: ${err.message || err}`;
    }
  },
};