meme-coin-audit

Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, metadata mutability), Token-2022 extension risks (transfer hooks, permanent delegate), DEX liquidity pool attacks (sandwich amplification, LP drain, bonding curve exploits), pump.fun/Raydium/Jupiter integration risks, and real exploit examples from 2024-2025. Use for any token audit, rug pull assessment, meme coin security review, or pre-investment due diligence.

Quality

87%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced audit skill with copy-paste greps, explicit kill-signal checkpoints, and a Foundry PoC scaffold. Its main gaps are minor prose over-explanation in the Operator Notes and a monolithic single-file structure with no progressive disclosure into reference files.

Suggestions

Move the Foundry PoC template and/or the Operator Notes into separate reference files under ./references/ and link to them from SKILL.md to improve progressive disclosure and reduce inline bulk.

Tighten the Operator Notes prose by dropping re-explanations of MEV/sandwich/bonding-curve basics that Claude already knows, keeping only the 2025-2026-specific signals and mitigations.

Add an explicit feedback loop for the audit workflow (e.g., 'if a kill signal fires, re-verify on-chain state before reporting') to lift workflow_clarity from a sequenced checklist to a validated, recovery-aware process.

Dimension	Reasoning	Score
Conciseness	Mostly lean — copy-paste greps, kill conditions, and checklists earn their tokens — but the Operator Notes prose re-explains some mechanics Claude already knows (sandwich/MEV, bonding-curve basics) alongside the 2025-2026 specifics, leaving minor over-explanation that could be trimmed.	4 / 5
Actionability	Highly actionable: every bug class ships a copy-paste-ready grep command with file-type filters, a full Foundry PoC test scaffold, and concrete Solana CLI checks ('spl-token display <MINT_ADDRESS> --program-id ...'), with explicit 'Kill if:' exit conditions.	5 / 5
Workflow Clarity	Clear sequenced workflow (PRE-DIVE KILL SIGNALS → 8 bug-class greps → FAST RED-FLAG SWEEP → out-of-band verification list → PoC → Solana checks) with validation checkpoints via the hard/soft kill gates and per-class 'Kill if' conditions; lacks an explicit fix-and-revalidate feedback loop, capping it below 5.	4 / 5
Progressive Disclosure	Well-sectioned with clear headers, but no bundle files exist and all content — including the ~80-line Foundry PoC template and the substantial Operator Notes block that could live in separate reference files — is inlined in a 358-line SKILL.md, so structure is present but content that should be split is inline.	3 / 5
	Total	16 / 20 Passed

Description

96%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that names concrete bug classes, platforms, and chain ecosystems with explicit 'Use for' trigger guidance. Its only weakness is acknowledged overlap with the sibling web3-audit skill for generic token-audit requests.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions with sub-techniques — 'rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass)', 'Solana SPL token analysis (freeze authority, mint authority, metadata mutability)', 'Token-2022 extension risks (transfer hooks, permanent delegate)', 'DEX liquidity pool attacks (sandwich amplification, LP drain, bonding curve exploits)' — covering EVM and Solana comprehensively.	5 / 5
Completeness	Explicitly answers both what (detailed capability list with named bug classes and platforms) and when ('Use for any token audit, rug pull assessment, meme coin security review, or pre-investment due diligence') with concrete trigger phrases.	5 / 5
Trigger Term Quality	The 'Use for any token audit, rug pull assessment, meme coin security review, or pre-investment due diligence' clause provides natural trigger phrases users would say, supplemented by synonyms (meme coin, token, rug pull) and platform names (pump.fun, Raydium, Jupiter).	5 / 5
Distinctiveness Conflict Risk	Carves a clear meme-coin/token niche with distinct triggers, but the body itself notes overlap with web3-audit (token bug classes are a subset of web3-audit's scope), so a generic 'token audit' request could plausibly trigger either skill — minor overlap risk rather than minimal.	4 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: elementalsouls/Claude-BugHunter
Path: skills/meme-coin-audit/SKILL.md
Commit: 0ce18ba

Reviewed: 1 day ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.