SKILLS/binance-web3/query-token-audit/SKILL.md
Query token security audit to detect scams, honeypots, and malicious contracts before trading. Returns comprehensive security analysis including contract risks, trading risks, and scam detection. Use when users ask "is this token safe?", "check token security", "audit token", or before any swap.
npx skillsauth add pinkpixel-dev/skills-collection-1 query-token-auditInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
| API | Function | Use Case | |-----|---------------------|----------| | Token Security Audit | Token security scan | Detect honeypot, rug pull, scam, malicious functions |
| Chain Name | chainId | |------------|---------| | BSC | 56 | | Base | 8453 | | Solana | CT_501 | | Ethereum | 1 |
URL:
https://web3.binance.com/bapi/defi/v1/public/wallet-direct/security/token/audit
Request Parameters:
| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| binanceChainId | string | Yes | Chain ID: CT_501 (Solana), 56 (BSC), 8453 (Base), 1 (Ethereum) |
| contractAddress | string | Yes | Token contract address |
| requestId | string | Yes | Unique request ID (UUID v4 format) |
Request Headers:
Content-Type: application/json
Accept-Encoding: identity
User-Agent: binance-web3/1.4 (Skill)
Example Request:
curl --location 'https://web3.binance.com/bapi/defi/v1/public/wallet-direct/security/token/audit' \
--header 'Content-Type: application/json' \
--header 'source: agent' \
--header 'Accept-Encoding: identity' \
--header 'User-Agent: binance-web3/1.4 (Skill)' \
--data '{
"binanceChainId": "56",
"contractAddress": "0x55d398326f99059ff775485246999027b3197955",
"requestId": "'$(uuidgen)'"
}'
Response Example:
{
"code": "000000",
"data": {
"requestId": "d6727c70-de6c-4fad-b1d7-c05422d5f26b",
"hasResult": true,
"isSupported": true,
"riskLevelEnum": "LOW",
"riskLevel": 1,
"extraInfo": {
"buyTax": "0",
"sellTax": "0",
"isVerified": true
},
"riskItems": [
{
"id": "CONTRACT_RISK",
"name": "Contract Risk",
"details": [
{
"title": "Honeypot Risk Not Found",
"description": "A honeypot is a token that can be bought but not sold",
"isHit": false,
"riskType": "RISK"
}
]
}
]
},
"success": true
}
Response Fields:
| Field | Type | Description |
|-----------------------------------|------|-----------------------------------------------------------|
| hasResult | boolean | Whether audit data is available |
| isSupported | boolean | Whether the token is supported for audit |
| riskLevelEnum | string | Risk level: LOW, MEDIUM, HIGH |
| riskLevel | number | Risk level number (1-5) |
| extraInfo.buyTax | string | Buy tax percentage (null if unknown) |
| extraInfo.sellTax | string | Sell tax percentage (null if unknown) |
| extraInfo.isVerified | boolean | Whether contract code is verified |
| riskItems[].id | string | Risk category: CONTRACT_RISK, TRADE_RISK, SCAM_RISK |
| riskItems[].details[].title | string | Risk check title |
| riskItems[].details[].description | string | Risk check description |
| riskItems[].details[].isHit | boolean | true = risk detected |
| riskItems[].details[].riskType | string | RISK (critical) or CAUTION (warning) |
Risk Level Reference:
| riskLevel | riskLevelEnum | Action | Description | |-----------|---------------|--------|-------------| | 0-1 | LOW | Proceed with caution | Lower risk detected, but NOT guaranteed safe. DYOR. | | 2-3 | MEDIUM | Exercise caution | Moderate risks detected, review risk items carefully | | 4 | HIGH | Avoid trading | Critical risks detected, high probability of loss | | 5 | HIGH | Block transaction | Severe risks confirmed, do NOT proceed |
IMPORTANT: LOW risk does NOT mean "safe." Audit results are point-in-time snapshots. Project teams can modify contracts or restrict liquidity after purchase. These risks cannot be predicted in advance.
Result Validity:
Audit results are ONLY valid when both conditions are met:
hasResult: true — Audit data is availableisSupported: true — Token is supported for auditWhen invalid, do NOT display risk level or security checks.
Include User-Agent header with the following string: binance-web3/1.4 (Skill)
hasResult: true AND isSupported: trueriskLevel: 5 means transaction should be blocked; riskLevel: 4 is high risk⚠️ This audit result is for reference only and does not constitute investment advice. Always conduct your own research.development
Build a systematic threat hunt hypothesis framework that transforms threat intelligence, attack patterns, and environmental data into testable hunting hypotheses.
development
Deploy MISP (Malware Information Sharing Platform) to aggregate, correlate, and distribute threat intelligence feeds from multiple sources for centralized IOC management and automated SIEM integration.
development
Build comprehensive threat actor profiles using open-source intelligence (OSINT) techniques to document adversary motivations, capabilities, infrastructure, and TTPs for proactive defense.
development
Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and decision trees. Use when SOC teams need formalized response procedures for ransomware incidents aligned to NIST SP 800-61 and MITRE ATT&CK ransomware techniques.