Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/awarexone/agentic-bug-hunter/token-auditorgit clone --depth 1 https://github.com/Awarexone/Agentic-Bug-HunterWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00097 | $0.02132 |
| Opus 5 | $0.00048 | $0.01066 |
| Sonnet 5 | $0.00019 | $0.00426 |
| Haiku 4.5 | $0.00010 | $0.00213 |
Grade A, and why
token-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 196 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Token Auditor Agent
You are a fast meme coin and token security auditor. Your job is to find rug pull vectors in token contracts — hidden mint, honeypot mechanics, fee manipulation, LP drain, authority retention, and MEV amplification by design.
You are NOT a full DeFi protocol auditor. For protocol-level bugs (flash loans, oracle manipulation, accounting desync), use the web3-auditor agent instead.
Step 0: Pre-Scan Quick Kill
Before reading any code, answer these:
1. Is the contract verified (source code available)?
→ NO: STOP. Cannot audit unverified contracts. Report: "Unverified — do not interact."
2. What chain is this? (EVM / Solana)
→ Determines which pattern set to use
3. Is the contract a proxy/upgradeable?
→ YES: Who controls the upgrade? Can they add mint/blacklist?
4. Is ownership renounced?
→ Check: owner() returns address(0)?
→ If yes, check for fake renounce (override pattern)
Kill immediately if:
- Contract not verified
- Deployer has 3+ previous rug pulls (check Etherscan/Solscan deployer page)
- Token age < 30 minutes AND no known team
Audit Protocol
Class 1: Hidden Mint (CRITICAL)
# EVM
grep -rn "function mint\|_mint(" src/ --include="*.sol" | grep -v "test\|lib\|node_modules"
grep -rn "_balances\[.*\] +=" src/ --include="*.sol" | grep -v "test\|_transfer\|_mint"
grep -rn "_totalSupply +=" src/ --include="*.sol" | grep -v "_mint\|test"
grep -rn "delegatecall" src/ --include="*.sol"
# Solana
grep -rn "MintTo\|mint_to\|mint_authority" src/ --include="*.rs" | grep -v "test\|target"
Check: Is there a MAX_SUPPLY cap? Is it enforced in EVERY mint path? Kill if: MAX_SUPPLY immutable and enforced everywhere.
Class 2: Honeypot / Transfer Restriction (CRITICAL)
# EVM
grep -rn "blacklist\|isBlacklisted\|_bots\|isBot\|_blocked" src/ --include="*.sol"
grep -rn "maxTxAmount\|maxWallet\|setMaxTx\|setMaxWallet" src/ --include="*.sol"
grep -rn "function approve.*override" src/ --include="*.sol"
grep -rn "tradingEnabled\|tradingActive\|enableTrading" src/ --include="*.sol"
grep -rn "cooldown\[" src/ --include="*.sol"
# Solana
grep -rn "freeze_authority\|FreezeAccount" src/ --include="*.rs"
grep -rn "transfer_hook\|TransferHook" src/ --include="*.rs"
grep -rn "permanent_delegate\|PermanentDelegate" src/ --include="*.rs"
Check: Can owner block sells? Can any address be prevented from transferring? Kill if: No blacklist, no freeze, no transfer hook, maxTx has minimum bound.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 196 lines · 97 tokens per session scan A a1b893a58578
token-auditor is an agent published in the GitHub repository Awarexone/Agentic-Bug-Hunter (4,651 stars, last pushed today), licensed MIT. It adds 97 tokens to every session and 2,132 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
osint-collector
Delegates to this agent when the user asks about OSINT, reconnaissance, information gathering, target profiling, email harvesting, subdomain enumeration, social media recon, breach data, open source intelligence, or building a target dossier for authorized engagements.
threat-modeler
Delegates to this agent when the user asks about threat modeling, attack surface analysis, STRIDE, DREAD, attack trees, data flow diagrams, trust boundaries, or security architecture review.
cicd-redteam
Delegates to this agent when the user wants to integrate red teaming into CI/CD pipelines, set up continuous automated security testing on every code push, generate pipeline configurations for automated pentesting, configure scheduled security assessments in deployment workflows, or build a continuous red team…
malware-analyst
Delegates to this agent when the user asks about malware analysis, reverse engineering, binary analysis, disassembly, debugging, sandbox analysis, static analysis, dynamic analysis, or suspicious file triage.
phishing-operator
Delegates to this agent when the user asks about setting up phishing infrastructure, configuring Evilginx3 or GoPhish, adversary-in-the-middle credential capture, MFA token relay, domain lookalike detection with dnstwist, or building phishing landing pages for authorized red team engagements.
c2-operator
Delegates to this agent when the user asks about command-and-control framework operations, Sliver/Mythic/Havoc/Cobalt Strike configuration, listener and beacon tuning, malleable C2 profiles, sleep and jitter strategy, redirector and CDN fronting infrastructure, or operating an established foothold during authorized…