An OpenClaw agent that buys a Base token before checking it can get rugged in one trade. The only question that matters first: if I buy this, can I sell it back out? Here is how to answer it — as a pre-trade gate — with one skill and an on-chain simulation, not a static guess.
# 1. Install the skill into your OpenClaw agent
openclaw skills install true402-token-safety
# 2. Zero-setup smoke test — the skill wraps this CLI, which tries the free daily trial first
npx @true402.dev/rugcheck 0x4ed4E862860beD51a9570b96d89aF5E1B0Efefed
# The CLI exits NON-ZERO on an AVOID verdict, so you can gate on it directly.
# Add --history to also read observed liquidity removals from true402's Base archive
# (the past, which a live simulation cannot see). Base only.
npx @true402.dev/rugcheck 0x4ed4E862860beD51a9570b96d89aF5E1B0Efefed --history
# 3. Wire it into your agent as a pre-trade gate.
# The true402-token-safety skill shells out to the rugcheck CLI; a non-zero
# exit == AVOID == do not buy.
import { execFileSync } from 'node:child_process';
function safeToTrade(token) {
try {
execFileSync('npx', ['@true402.dev/rugcheck', token], { stdio: 'inherit' });
return true; // exit 0 -> ok / caution -> tradeable
} catch {
return false; // non-zero -> AVOID -> trapped or a rug
}
}
async function maybeBuy(token, amount) {
if (!safeToTrade(token)) return; // gate: skip the buy on AVOID
await swap(token, amount); // your existing buy path
}
# Free daily trial needs no wallet. For unlimited paid checks, point the CLI at a
# payer wallet holding a little USDC on Base — no account, no API key:
# PAYER_PRIVATE_KEY=0x... npx @true402.dev/rugcheck 0x<token>Install the skill straight into your OpenClaw agent with openclaw skills install true402-token-safety. It is an OpenClaw ecosystem skill listed on ClawHub — there is no package-manager step and no key to configure to get started.
Under the hood the skill wraps the npx @true402.dev/rugcheck 0x<token> CLI. You can run that same command by hand to smoke-test any Base ERC-20 before you wire it into agent logic — it needs zero setup and tries true402's free daily trial first.
Browse the skill page at clawhub.ai/true402/skills/true402-token-safety.
The pattern is a pre-trade gate: run the check, read the verdict, and only fall through to your swap when it clears. The rugcheck CLI makes this a one-liner because it exits non-zero on an AVOID verdict — you do not have to parse JSON to gate on it.
true402-token-safety skill on that address.The verdict is a composite avoid | caution | ok rating from true402's token-report stall (POST /v1/base/token-report, ~$0.01). Put the gate in front of every buy, not just the ones that look suspicious.
That verdict is point-in-time: it proves the token is sellable right now. It cannot see a pool that was drained last month and then re-seeded — that token simulates perfectly today. Add --history to the same command and the skill also reads true402's archive of observed liquidity removals on Base (POST /v1/base/liquidity-history, ~$0.005), including the other tokens whose liquidity left in the same transaction — one transaction draining several pools is one operator working through a list. Two rules when your agent relays it: none observed is not clean (the output states the block range the archive covers), and the flag is Base-only, so on another chain it says so and is skipped rather than printing an empty result that reads like a pass.
A honeypot hides its trap in the transfer logic — ownership, mint, and liquidity can all look clean while the sell path is blocked or taxed. A static contract scan reads the bytecode and guesses, and can be fooled.
true402 instead runs a real on-chain buy/sell honeypot simulation using a state-override eth_call — it proves sellability rather than reading a static scan. On top of that it checks liquidity, ownership / mint authority, and deployer reputation. A token can lie to a scanner; it cannot lie to a trade it just failed.
Your agent has a wallet, not a credit card. true402 is x402-native: the wallet is the identity. Safety stalls include a small free daily trial that needs no wallet at all, so you can install and test with zero funding.
For unlimited checks it pays per call in USDC on Base — no sign-up, no API key, nothing to rotate. Point the CLI at a payer wallet holding a little USDC (PAYER_PRIVATE_KEY=0x...) and it pays only when it needs an answer. Beyond token-report, the same account-free rail exposes token-safety (structural score 0–100, ~$0.005), address-safety (~$0.005), deployer-check (~$0.008), tx-preflight (~$0.008) and liquidity-history (~$0.005) at API base true402.dev/api. deployer-check is the one stall with no free trial — it depends on a keyed third-party explorer API, so it is paid from the first call.
Try a token now at true402.dev/check, or read the endpoint reference at true402.dev/docs/api.
Run openclaw skills install true402-token-safety to add the skill. It wraps the npx @true402.dev/rugcheck 0x<token> CLI, which exits non-zero on an AVOID verdict. Call it before any buy and gate the trade on the exit code, so your agent skips tokens that fail the check.
You run the safety check first and only execute the swap when it clears. Because the rugcheck CLI exits non-zero on AVOID, the gate is a simple conditional: on a non-zero exit skip the buy and log the reason; on exit 0 fall through to your existing swap. Put it in front of every buy.
A honeypot hides its trap in transfer logic, so ownership, mint, and liquidity can look clean while the sell path is blocked. true402 runs a real buy/sell simulation with a state-override eth_call to prove sellability, plus liquidity, ownership, and deployer reputation. A token can fool a scanner but not a trade it just failed.
No. true402 is x402-native, so the wallet is the identity — no sign-up, no API key, no KYC. Safety stalls include a small free daily trial that needs no wallet. For unlimited checks the agent pays per call in USDC on Base by pointing the CLI at a funded payer wallet.
Run npx @true402.dev/rugcheck 0x<token> with no configuration — it tries the free daily trial first, so a few checks a day cost nothing and need no wallet. You can also try any token in the browser at true402.dev/check before wiring the skill into your agent.