Evaluates a crypto token's contract for scam risks and flags its safety level with reasons for trading and decision-making purposes.

This package is inconsistent: the documentation and scan.js implement a token scanner that calls a public Base RPC and an external honeypot API, but the declared entrypoint (index.js) does nothing. Before installing or enabling: 1) ask the author to fix the entrypoint so the runtime executes the scanner you expect (or explain why index.js is the real entry); 2) require a package.json or install instructions for ethers/axios; 3) confirm you are OK with the token address being sent to https://api.honeypot.is and using the Base RPC (privacy/telemetry concerns); and 4) if you need scans for other chains, request chain selection rather than a hardcoded 'base'. Because of the entrypoint mismatch and missing dependency metadata, treat this skill as suspicious until the author clarifies/corrects these issues.

Type: OpenClaw Skill Name: is-token-safe Version: 1.0.0 The skill is functionally broken as its entry point (`index.js.js`) is a no-op, simply returning the input without performing any token analysis. The actual analysis logic resides in `scan.js.js`, which is a standalone script and not called by `index.js.js`. While `scan.js.js` makes external network calls to `https://mainnet.base.org` (blockchain RPC) and `https://api.honeypot.is` (token safety API), these are legitimate for the skill's stated purpose and do not involve exfiltration of sensitive data or malicious execution. The `SKILL.md` documentation contains no prompt injection attempts. The bundle is benign, though non-functional as intended.