Skills/ClawHub/true402-token-safety

true402-token-safety@1.2.4

CAUTION

Publisher claims: "Rug-check a Base token before trading — real buy/sell honeypot simulation, liquidity and ownership checks, plus its observed liquidity-removal history. Free daily checks; ~$0.008/call via x402 after." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher true402 · joined 0 days agoInstalls 1,025Last detonated 1 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

HIGH

npx invocation of non-well-known packageSKILL.md:34 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageSKILL.md:11 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageSKILL.md:61 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:30 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageREADME.md:60 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageSKILL.md:44 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsREADME.md:45 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Process kill commandSKILL.md:49 · Process kill command — agent can terminate processes

AST05