web3-risk-check

name	web3-risk-check
description	Web3-specific risk screening for dApp domains, protocol pages, token contracts/mints, and project legitimacy. Use when the user asks whether a crypto/Web3 project, dApp URL, token, contract, or protocol looks risky, scammy, unaudited, illiquid, honeypot-like, or worth adding to a portfolio risk workflow.
version	1.0.0
author	web3blind / Hermes Agent
license	MIT
metadata	{"hermes":{"tags":["web3","risk","defi","token","dapp","security"],"related_skills":["security","portfolio-review","defi-project-analysis"]}}

Web3 Risk Check

Scope

Use this skill for Web3-native risk screening, not generic antivirus or ordinary website reputation.

Good inputs:

• dApp URL/domain: https://app.hyperliquid.xyz, hyperliquid.xyz
• protocol/project name: Hyperliquid, Kamino, Pendle
• EVM token contract + chain id/name
• Solana token mint
• wallet-facing app before connecting/signing
• portfolio positions that need protocol/token risk context

Do not lead with generic malware/URL scanners unless the user explicitly asks for phishing/malware/brand impersonation. the user corrected this: for this class of work he wants Web3 project/token risk, not “viruses”.

Core Principle

No single free API is authoritative. Build a layered verdict:

1. Project/domain legitimacy layer — is the domain known as a real Web3 protocol/app?
2. Protocol context layer — TVL, category, chains, audits, listed age, official links.
3. Token/contract layer — honeypot, taxes, ownership, mintability, blacklist, verified source.
4. Market/liquidity layer — DEX liquidity, volume, pair age, FDV/market cap, suspicious thin markets.
5. Report/incident layer — scam/rug reports if a Web3-specific source is available.

Always mark uncertainty. not found in one provider is not a scam verdict.

Provider Order

For dApp domain / protocol URL

1. DeFiLlama free API — first-line project/protocol registry.

   • Use to match domain/project name and extract url, category, chains, tvl, audits, audit_links, twitter, listedAt, parentProtocol.
   • Public endpoint: https://api.llama.fi/protocols.
   • Strong for established DeFi protocols; not a security verdict, but excellent legitimacy/context.

2. GoPlus dApp Security — optional second signal, not authoritative.

   • Endpoint: https://api.gopluslabs.io/api/v1/dapp_security?url=<url-or-domain>.
   • If it returns DAPP not found, report “GoPlus has no dApp record”, not “unsafe”.

3. WalletConnect/Reown Verify — useful conceptually for wallet session risk, but do not assume there is a simple public REST lookup.

   • In WalletConnect flows, relevant fields are validation (VALID, INVALID, UNKNOWN), origin, and isScam.
   • Treat as a future spike unless a working endpoint/SDK path is confirmed.

4. Commercial/unclear providers — Blockaid, Blowfish, Webacy, PhishFort/BrandShield, ScamSniffer, Kerberus.

   • Mention as possible paid/partner integrations only after checking current docs.
   • Do not build a free workflow around them without verifying public API access.

For EVM token contract

1. GoPlus Token Security

   • Endpoint: https://api.gopluslabs.io/api/v1/token_security/{chain_id}?contract_addresses=<address>.
   • Extract: honeypot flags, buy/sell tax, mintability, blacklist/whitelist, owner privileges, proxy, open source, holder concentration, creator risk.

2. Honeypot.is

   • Endpoint: https://api.honeypot.is/v2/IsHoneypot?address=<address>&chainID=<chain_id>.
   • Extract: summary.risk, riskLevel, honeypotResult.isHoneypot, simulationSuccess, buy/sell/transfer tax, liquidity/pair, contract open-source/proxy.
   • Docs have stated API key system may not be required yet, but this can change.

3. DEX Screener

   • Endpoint: https://api.dexscreener.com/latest/dex/tokens/<address>.
   • Use for liquidity/volume/pair context, not as a security verdict.

4. Sourcify / explorer verification

   • Use to check whether EVM source is verified/full-match when contract transparency matters.

For Solana token mint

1. RugCheck.xyz

   • Summary: https://api.rugcheck.xyz/v1/tokens/<mint>/report/summary
   • Full report: https://api.rugcheck.xyz/v1/tokens/<mint>/report
   • Extract: risk score, risks list, LP locked, metadata, insiders/holders where available.

2. DEX Screener

   • Use for liquidity, pair age, volume, FDV/market context.

3. DeFiLlama

   • If the mint belongs to a known protocol/project, use protocol context too.

Output Shape

Keep it compact and decision-oriented:

1. Verdict: low / medium / high / critical / unknown.
2. What was checked: providers and whether each had data.
3. Positive signals: known protocol, matching domain, high TVL, audits, verified source, normal sell simulation, healthy liquidity.
4. Risk signals: honeypot, failed sell simulation, high tax, mutable/owner privileges, unverified source, low liquidity, young pair, bad/unknown domain, missing audits.
5. Interpretation: what the signals mean and what they do not prove.
6. Next action: connect small / avoid / research audits / check contract manually / monitor only.

Important Pitfalls

• Do not conflate generic web security with Web3 risk. VirusTotal/Google Safe Browsing are not first-line tools here.
• GoPlus dapp_security has incomplete coverage; even large projects may return DAPP not found.
• DeFiLlama presence is not proof of safety; it is evidence of ecosystem recognition and provides context.
• DEX Screener is market context, not security.
• Honeypot simulation can fail or be chain/liquidity dependent; treat failures as unknown/high caution, not always malicious.
• RugCheck is strongest for Solana; do not apply it to EVM.
• A single numeric risk score should not be the final answer. Explain the strongest signals.

References

• See references/web3-risk-api-map.md for the current provider map, endpoints, and Hyperliquid/GoPlus coverage example from the research session.