Token rug pull and honeypot checker

Investigation Report is an aeon skill: One-shot Base-token investigation - runs any subset of six onchain-security checks (rug-scan, contract-audit, deployer-trace, holder-concentration, honeypot, lp-lock) into one verdict. Keyless core. Like every aeon skill it is one SKILL.md prompt file that runs unattended on your own GitHub Actions, on a schedule or when you trigger it, and sends what it finds to Telegram, Discord, Slack or email.

The "tell me everything about this token" skill. Instead of running six checks by hand, this composes them into one structured report behind a selector: rug risk, contract audit (verification / owner powers / proxy), deployer trace (who shipped it and their history), holder concentration (whale risk), honeypot (can you actually sell?), and LP lock (can the team pull liquidity?) - with a one-line summary on top.

Designed to degrade gracefully: each selected section runs independently, so a section that needs a key (or returns nothing) is marked unavailable without aborting the rest. Selecting a single check makes the composite behave as that one analyzer - same steps, same thresholds, same notify format, same status codes.

Every aeon skill takes one optional text input, var, set in aeon.yml or typed in when you run it by hand. It picks the target or the mode for that run.

Base subject to investigate, plus optional flags: <token-address> [--checks=rug,contract,deployer,holders,honeypot,lp] [--depth=quick|deep]. The first token is the subject contract address (0x…, required). --checks= is a comma-list selecting which analyzers to run (default = all six). --depth= is quick (the old rug-scan fast path - minimal reads) or deep (full standalone logic of each selected check; default). If the subject address is empty, log REPORT_NO_TARGET and exit cleanly (no notify).

Examples:

• 0xToken → all six checks, deep report.
• 0xToken --checks=honeypot → only the honeypot simulation (reproduces the standalone honeypot-check exactly, incl. its HONEYPOT_* end-states).
• 0xToken --checks=rug,lp --depth=quick → rug verdict + LP-lock, fast path.
• 0xToken --checks=contract,deployer,holders --depth=deep → structural audit + deployer entity intel + full concentration.

Besides the model you connected to aeon, Investigation Report uses the following. Add secrets as GitHub Actions secrets on your aeon repo, or in Aeon Connect.

• ETHERSCAN_API_KEY - optional secret, unlocks more data or features
• BASESCAN_API_KEY - optional secret, unlocks more data or features
• BASE_RPC_URL - optional secret, unlocks more data or features

Easiest: open Aeon Connect, sign in with GitHub and turn on Investigation Report. No clone, no terminal. To add it to an existing aeon repo from a shell, run:

Then switch it on in aeon.yml (the default schedule is filled in):

skills:
  investigation-report: { enabled: true, schedule: "workflow_dispatch", var: "" }

New to aeon? Read the docs for how skills, schedules and memory fit together, or browse all skills.