Rug Checker

Rug Checker — Agent Skill Definition

Skill Metadata

Activation Triggers

Activate this skill when the user's message matches any of these patterns:

Note: If the user asks "Should I buy [token]?", redirect: "I can't advise on whether to buy — but I can check the on-chain risk factors for you." Then run the analysis.

Address detection: If the user provides a base58 string of 32-44 characters, treat it as a Solana token address. If they provide a name/symbol, resolve it first.

Agent Workflow

Step 1: Extract the Token

Parse the user's message for either:

• A Solana address (base58, 32-44 chars matching [1-9A-HJ-NP-Za-km-z]{32,44})
• A token name or symbol (e.g., "BONK", "bonk", "Wheelchair Fish")

If unclear, ask: "Which token would you like me to check? Give me the contract address or token name."

Step 2: Resolve the Token

bash scripts/detect-token.sh <address_or_name>

Output varies by input type:

If given a Solana address: JSON with found: true/false, address, name, symbol, market data.

If given a name/symbol: JSON with ambiguous: true and a candidates array containing up to 5 matches with address, name, symbol, liquidity, and age. If detect-token returns candidates, you MUST present them to the user and ask which one they mean. NEVER auto-pick a candidate. Checking the wrong token is worse than not checking at all.

Example candidate response:

{
  "query": "bonk",
  "ambiguous": true,
  "candidates": [
    {"address": "DezXAZ8z...", "name": "Bonk", "symbol": "BONK", "liquidity_usd": 5000000, "age": "400d"},
    {"address": "56Lc5...", "name": "BonkFork", "symbol": "BONK", "liquidity_usd": 12000, "age": "3d"}
  ]
}

Present candidates as a numbered list:

I found multiple tokens matching "bonk". Which one did you mean?

1. BONK (Bonk) — DezXAZ8z... — $5.0M liquidity, 400d old
2. BONK (BonkFork) — 56Lc5... — $12K liquidity, 3d old

Then re-run with the confirmed mint address.

If found: false (and not ambiguous), tell the user the token couldn't be found and ask them to double-check the address.

Step 3: Run Risk Analysis

bash scripts/analyze-risk.sh <token_address>

Output: JSON with 10 risk checks, composite score (0-100), tier (SAFE/CAUTION/WARNING/DANGER/CRITICAL).

Step 4: Generate Report

bash scripts/analyze-risk.sh <address> | bash scripts/format-report.sh

Or pipe the saved JSON:

bash scripts/format-report.sh < analysis.json

Output: Formatted Markdown report card with visual risk bars, market overview, and links.

Step 5: Present to User

Display the formatted report. Add brief commentary based on the tier:

Always end with the disclaimer (it's built into format-report.sh). Never use language that implies a buy/sell recommendation (e.g., "looks solid", "good investment", "safe bet").

Discord v2 Delivery Mode (OpenClaw v2026.2.14+)

When running in a Discord channel:

• Send a compact first message with: token, tier, score, and top 3 risk drivers.
• Keep the first message under ~1200 characters; avoid rendering the full long report first.
• If Discord components are available, include quick actions:
  • Show Full Risk Breakdown
  • Show Data Sources
  • Re-Run Check
• If components are unavailable, provide the same options as a numbered list.
• For long reports, send in short chunks (<=15 lines) to avoid noisy channel spam.

Error Handling

Data Sources

Risk Checks (10 points)

Safety

⚠️ NOT Financial Advice — This Is Non-Negotiable

This skill provides informational risk signals only. The agent MUST NOT:

• Recommend buying or selling any token — ever
• Use language implying a token is a "good buy", "looks solid", or is "safe to invest in"
• Frame analysis results as investment validation
• Guarantee any token is safe or unsafe
• Replace professional financial advice
• Account for off-chain risks (team, legal, regulatory, market sentiment)

A low risk score means low on-chain risk indicators were detected — it does NOT mean the token is a good investment or free from risk.

🔒 Read-Only

This skill:

• Never interacts with any wallet
• Never signs or submits any transaction
• Never requests private keys or seed phrases
• Never sends tokens or funds
• Only reads publicly available on-chain data and public API endpoints

🛡️ No API Keys

All data sources are free, public APIs. No API keys are stored or transmitted.

Example Prompts

"Rug check DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263"
"Is BONK safe?"
"Check this token for me: 5smiafTeV4ATT6naUWTwzcsvix4VU9nQ7ReyzKiqpump"
"Is this a rug pull? [address]"
"Analyze the risk on this Solana token"
"Do a safety check on $WIF"

Dependencies

• bash 4+
• curl
• jq
• bc (for floating-point comparisons)
• Internet access to: api.rugcheck.xyz, api.dexscreener.com, api.mainnet-beta.solana.com