query-token-audit
Query token security audit to detect scams, honeypots, and malicious contracts before trading. Returns comprehensive security analysis including contract risks, trading risks, and scam detection. Use when users ask "is this token safe?", "check token security", "audit token", or before any swap.
- Installs
- 8.3K
- Last 24h
- +451
- Trending rank
- #723
- Security
- Pass
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/binance/binance-skills-hub --skill query-token-audit- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads query-token-audit automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
Security audits
Independent scans of the skill's instructions and bundled files.
SKILL.md
The instructions your agent reads when the skill is triggered.
Query Token Audit Skill
Overview
| API | Function | Use Case |
|---|---|---|
| Token Security Audit | Token security scan | Detect honeypot, rug pull, scam, malicious functions |
Use Cases
- Pre-Trade Safety Check: Verify token security before buying or swapping
- Scam Detection: Identify honeypots, fake tokens, and malicious contracts
- Contract Analysis: Check for dangerous ownership functions and hidden risks
- Tax Verification: Detect unusual buy/sell taxes before trading
Supported Chains
| Chain Name | chainId |
|---|---|
| BSC | 56 |
| Base | 8453 |
| Solana | CT_501 |
| Ethereum | 1 |
API: Token Security Audit
Method: POST
URL:
https://web3.binance.com/bapi/defi/v1/public/wallet-direct/security/token/audit
Request Parameters:
| Parameter | Type | Required | Description |
|---|---|---|---|
| binanceChainId | string | Yes | Chain ID: CT_501 (Solana), 56 (BSC), 8453 (Base), 1 (Ethereum) |
| contractAddress | string | Yes | Token contract address |
| requestId | string | Yes | Unique request ID (UUID v4 format) |
Request Headers:
Content-Type: application/json
Accept-Encoding: identity
User-Agent: binance-web3/1.4 (Skill)
Example Request:
curl --location 'https://web3.binance.com/bapi/defi/v1/public/wallet-direct/security/token/audit' \
--header 'Content-Type: application/json' \
--header 'source: agent' \
--header 'Accept-Encoding: identity' \
--header 'User-Agent: binance-web3/1.4 (Skill)' \
--data '{
"binanceChainId": "56",
"contractAddress": "0x55d398326f99059ff775485246999027b3197955",
"requestId": "'$(uuidgen)'"
}'
Response Example:
{
"code": "000000",
"data": {
"requestId": "d6727c70-de6c-4fad-b1d7-c05422d5f26b",
"hasResult": true,
"isSupported": true,
"riskLevelEnum": "LOW",
"riskLevel": 1,
"extraInfo": {
"buyTax": "0",
"sellTax": "0",
"isVerified": true
},
"riskItems": [
{
"id": "CONTRACT_RISK",
"name": "Contract Risk",
"details": [
{
"title": "Honeypot Risk Not Found",
"description": "A honeypot is a token that can be bought but not sold",
"isHit": false,
"riskType": "RISK"
}
]
}
]
},
"success": true
}
Response Fields:
| Field | Type | Description |
|---|---|---|
| hasResult | boolean | Whether audit data is available |
| isSupported | boolean | Whether the token is supported for audit |
| riskLevelEnum | string | Risk level: LOW, MEDIUM, HIGH |
| riskLevel | number | Risk level number (1-5) |
| extraInfo.buyTax | string | Buy tax percentage (null if unknown) |
| extraInfo.sellTax | string | Sell tax percentage (null if unknown) |
| extraInfo.isVerified | boolean | Whether contract code is verified |
| riskItems[].id | string | Risk category: CONTRACT_RISK, TRADE_RISK, SCAM_RISK |
| riskItems[].details[].title | string | Risk check title |
| riskItems[].details[].description | string | Risk check description |
| riskItems[].details[].isHit | boolean | true = risk detected |
| riskItems[].details[].riskType | string | RISK (critical) or CAUTION (warning) |
Risk Level Reference:
| riskLevel | riskLevelEnum | Action | Description |
|---|---|---|---|
| 0-1 | LOW | Proceed with caution | Lower risk detected, but NOT guaranteed safe. DYOR. |
| 2-3 | MEDIUM | Exercise caution | Moderate risks detected, review risk items carefully |
| 4 | HIGH | Avoid trading | Critical risks detected, high probability of loss |
| 5 | HIGH | Block transaction | Severe risks confirmed, do NOT proceed |
IMPORTANT: LOW risk does NOT mean "safe." Audit results are point-in-time snapshots. Project teams can modify contracts or restrict liquidity after purchase. These risks cannot be predicted in advance.
Response Handling:
- If
hasResult=falseORisSupported=false: → Reply: "Security audit data is not available for this token on this chain." → Do NOT showriskLevel,riskLevelEnum, orriskItems(data is unreliable when either field is false) → You may suggest the user verify the contract address and chain, or try again later - If
hasResult=trueANDisSupported=true: → Show the full audit result including risk level, tax info, and all risk items → Apply the Risk Level Reference table above for actionable guidance
User Agent Header
Include User-Agent header with the following string: binance-web3/1.4 (Skill)
Notes
- All numeric fields are string format, convert when using
- Audit results are ONLY valid when
hasResult: trueANDisSupported: true riskLevel: 5means transaction should be blocked;riskLevel: 4is high risk- Tax thresholds: >10% is critical, 5-10% is warning, <5% is acceptable
- Generate unique UUID v4 for each audit request
- Only output security check risk flags, do NOT provide any investment advice
- Always end with disclaimer:
⚠️ This audit result is for reference only and does not constitute investment advice. Always conduct your own research.
FAQ
What does the query-token-audit skill do?
Query token security audit to detect scams, honeypots, and malicious contracts before trading. Returns comprehensive security analysis including contract risks, trading risks, and scam detection. Use when users ask "is this token safe?", "check token security", "audit token", or before any swap.
How do I install query-token-audit?
Run npx skills add https://github.com/binance/binance-skills-hub --skill query-token-audit in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/query-token-audit/ (personal) or .claude/skills/query-token-audit/ (project).
Which AI agents can use query-token-audit?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is query-token-audit safe to install?
Security partners have reviewed it: Gen Agent Trust Hub passed; Socket passed; Snyk passed; Runlayer passed; ZeroLeaks passed. As with any skill, read the SKILL.md and bundled scripts before installing.
Who maintains query-token-audit?
It is published by binance in binance/binance-skills-hub. It has 8,280 recorded installs.
More from binance/binance-skills-hub
square-post
binance/binance-skills-hub
Use when the user wants to publish new content to Binance Square — short text, multi-image posts (up to 4), long-form articles with an optional cover, or videos with an auto-generated cover frame. Trigger on direct phrasings like "post to Square", "publish to Binance Square", "发广场", "发布到广场", and on near-miss intents where the user clearly wants to share or publish content on Square even without naming the skill: "share this analysis on Square", "把这篇文章发出去", "发个动态", "把这个视频上传到广场", "publish my chart to Square as an article". Also use when the user provides media (images, video) plus a caption and asks to push it to Square, or asks to turn a draft into a Square article. Do not use for reading, searching, commenting, liking, editing, deleting, scheduling, or managing existing Square posts — this skill only creates new posts.
binance-agentic-wallet
binance/binance-skills-hub
Use when the user mentions wallet connect/sign in/sign out, check balance, send/transfer tokens, swap/buy/sell tokens, DEX trade, limit/market order, cancel order, get a quote, transaction history, wallet settings, daily limit, slippage, MEV protection, supported chains, send to ENS domain, send to .eth or .bnb name, resolve domain name to address, domain-based transfer, send to .ai Agent ID name, Agent ID claim status, whether I claimed my .ai space id / Agent ID, get my .ai domain, prediction market, place prediction, redeem winnings, prediction PnL, x402 payment, HTTP 402 Payment Required, check/revoke/manage token approvals, DeFi protocols, staking, liquidity pool, LP, yield farming, deposit, redeem, stake, unstake, claim rewards/fees, health factor, APY, TVL, sign external transaction, contract call, sign message, EIP-712, developer mode, speed up/cancel/replace transaction, pending/stuck transactions, gas price, gas fee, network fee, fee levels, gas tiers, or any on-chain wallet
trading-signal
binance/binance-skills-hub
Per-trade smart-money signals — each result is a discrete buy or sell event from a tracked smart-money wallet, with trigger price, current price, max gain since trigger, and exit rate. BSC and Solana only. Use for: "smart money buy signal on $X", "any whale just bought $Y", "alpha signals in the last hour", "copy-trade-worthy signals", "trigger price and max gain on these trades", "on-chain trading signals from smart money".
crypto-market-rank
binance/binance-skills-hub
Crypto market leaderboards — ranked aggregate feeds across the whole market: social-hype/sentiment rank, trending / top-search / Binance Alpha / tokenized-stocks rank, smart-money net-inflow rank (which tokens received the most inflow), top meme tokens by breakout score on Pulse launchpad, top trader PnL leaderboard (ALL / KOL). Use whenever the user wants a ranked list of tokens or addresses by some metric — phrases like "trending tokens", "top N by hype", "leaderboard", "rank by X", "biggest inflows", "top traders this week".
query-token-info
binance/binance-skills-hub
Per-token details for a specific token identified by keyword, symbol, or contract address: (1) search — find tokens by keyword/symbol/contract; (2) meta — static info: name, symbol, logo, social links, creator, official website; (3) dynamic — real-time market data: price, 24h change, volume, holder count, liquidity; (4) kline — OHLCV candlestick data for technical analysis. Use for: "price of $X", "search for token Y", "kline chart for $Z", "who created $W", "social links for $V", "holder count of $U", "candlestick data", "find the contract address of ".
meme-rush
binance/binance-skills-hub
Live launchpad feed + AI hot topics for meme tokens. (1) meme-rush: real-time lifecycle feed on launchpads across Solana, BSC and Base (Pump.fun, Four.meme, Flap, ...) — brand-new launches, currently-finalizing / bonding-curve tokens, and just-migrated-to-DEX tokens; filter by dev behavior, age, market cap, and launchpad sub-type (e.g. Open Four Agent ID exclusive launches — anyone can launch; on the bonding curve only Agent ID holders can buy). (2) topic-rush: AI-detected hot market narratives with the associated tokens ranked by inflow. Use for: "new pump.fun launches", "what just migrated", "currently bonding", "hot narratives", "what topic is pumping right now", "live launchpad feed", "AI hot topics", "Agent ID exclusive launches", "Agent ID exclusive bonding curve", "Open Four".
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.