meme-coin-audit

Detects rug pulls and token vulnerabilities in EVM and Solana meme coins.

1|Updated Aug 21, 2026
One-click install
npx skills add https://github.com/marcboggs/BMAD-AppSec-Orchestrator --skill meme-coin-audit-marcboggs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: meme-coin-audit
Source: https://github.com/marcboggs/BMAD-AppSec-Orchestrator/tree/main/.claude/skills/meme-coin-audit
Command: npx skills add https://github.com/marcboggs/BMAD-AppSec-Orchestrator --skill meme-coin-audit-marcboggs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Investors and auditors face constant rug pull risk when evaluating meme coins and tokens, where hidden mint functions, honeypots, and retained authorities let deployers drain funds. This Skill provides a structured audit methodology to identify these threats before investing or reporting. ## Core Features & Use Cases - Kill-Signal Triage: Pre-audit hard and soft kill checks (unverified contracts, retained mint/freeze authority, LP lock status) to skip obvious rugs in minutes. - 8 Token Bug Classes: Systematic grep patterns and detection logic for hidden mints, honeypots, fee manipulation, LP drains, bonding curve exploits, authority retention, fake renounces, and sandwich amplification. - Solana & Token-2022 Analysis: On-chain authority checks, transfer hook and permanent delegate detection, pump.fun bonding curve verification, and LP lock contract validation. - Use Case: Before buying a new Solana token, run the 6-question fast filter (mint authority null, freeze authority null, LP locked 6+ months, holder concentration, bonding curve completion) to decide whether to invest or walk away. ## Quick Start Audit this token contract for rug pull vectors and check whether its mint and freeze authorities have been revoked.

Frequently Asked Questions about meme-coin-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check if a Solana token is a rug pull?▼

Check the mint authority and freeze authority using solana account or spl-token display commands; both should be null. Then verify LP is burned or locked in a verified contract, and confirm top 10 holders own under 30% of supply excluding pools.

How to detect a honeypot token before buying?▼

Simulate a buy, then a transfer to a second wallet, then a sell. If buy and transfer succeed but sell fails or applies over 50% tax, it is a honeypot. Cross-verify with rugcheck.xyz, honeypot.is, and dexscreener risk signals.

What are Token-2022 transfer hook risks on Solana?▼

Token-2022 transfer hooks let an authority pause, blacklist, or fee arbitrary addresses post-launch. If the hook authority or permanent delegate is non-null, that key holder can revoke transfer rights or move any holder's tokens, which is rug-class risk.

Can I trust LP lock badges on DexScreener?▼

No, LP lock badges require on-chain verification. Check the actual lock contract for the unlock timestamp, lock owner, and whether the owner can shorten the lock. Some locks are 1-day locks renewed weekly, which look identical to year-long locks.

What are the limitations of automated token scanners?▼

Regex-based scanners catch code patterns like mint functions and blacklist mappings but cannot check on-chain state, holder distribution, LP lock status, or deployer wallet history. Those require manual checks via Etherscan, Solscan, Birdeye, and lock contract explorers.