SafeToken.fun

Discover and use SafeToken.fun — fair memecoin launchpad on BNB Chain. Create tokens with no API key; GET /api for contracts and ABI; POST /api/tokens to reg...

This skill appears coherent with its stated purpose, but take these precautions before installing or using it: - Verify the site and API are legitimate (the SKILL.md lists a contact but no homepage metadata beyond the base URL). Consider manually visiting https://safetoken.fun and inspecting the API manifest and contract addresses before automated use. - Do NOT give the agent private keys or wallet secrets. If you need to sign transactions, use an offline or separate signing flow (e.g., local wallet, hardware signer) and avoid storing keys in environment variables accessible to the agent. - Review the token factory and launchpad smart contract code (on-chain or via the ABI/address returned by GET /api) before deploying funds or creating tokens. - Understand that registering a token via POST /api/tokens publishes metadata (mint, creator address, etc.) to the service and is public. - Because the skill came from an unknown source and has no install artifacts, prefer running it with limited privileges and monitor network activity when the agent interacts with the service. If you want a higher-confidence assessment, provide the service homepage, the API manifest URL response, or the smart contract addresses/ABI so those can be inspected.

Type: OpenClaw Skill Name: safetoken-fun Version: 1.0.0 The safetoken-fun skill bundle is classified as suspicious because it instructs the AI agent to dynamically retrieve contract ABIs and addresses from a remote endpoint (https://safetoken.fun/api) to perform financial transactions on the BNB Chain (SKILL.md). This design pattern is a significant security vulnerability, as it allows a third-party server to dictate the logic of the agent's on-chain operations, potentially leading to unauthorized fund transfers if the site is compromised. Additionally, the _meta.json file contains a future-dated publication timestamp (July 2026), which is an unusual anomaly in the metadata.