skillpp 0.1.0

package/skills/binance-web3/meme-rush/references/cli.md

@@ -0,0 +1,158 @@
+# meme-rush — CLI Reference
+
+Complete reference for every command in `scripts/cli.mjs`.
+
+**Invocation pattern:** `node <skill-dir>/scripts/cli.mjs <command> '<json_params>'`
+**Exit codes:** `0` success · `1` usage/upstream error · `3` network failure
+
+**Supported chains:** BSC (`56`), Solana (`CT_501`).
+
+---
+
+## `meme-rush` — Launchpad lifecycle tracking 
+
+> ⚠️ `rankType` selects the lifecycle stage: `10`=New (freshly created, on bonding curve) · `20`=Finalizing (bonding curve nearly complete, about to migrate) · `30`=Migrated (just migrated to DEX).
+
+```bash
+node <skill-dir>/scripts/cli.mjs meme-rush '{"chainId":"CT_501","rankType":10,"limit":20}'
+```
+
+### Parameters (body is a JSON object; only `chainId` + `rankType` are required)
+
+**Core:**
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `chainId` | string | **yes** | `"56"` (BSC) or `"CT_501"` (Solana) |
+| `rankType` | integer | **yes** | `10`=New · `20`=Finalizing · `30`=Migrated |
+| `limit` | integer | no | Max results (default 40, max 200) |
+| `keywords` / `excludes` | string[] | no | Include / exclude symbol patterns (max 5 each) |
+
+**Token filters (Min/Max pairs):** `progress` (string, 0–100) · `tokenAge` (long) · `holders` (long) · `liquidity` (string) · `volume` (string) · `marketCap` (string) · `count` / `countBuy` / `countSell` (long).
+
+**Holder distribution filters (Min/Max, string %):** `holdersTop10Percent` · `holdersDevPercent` · `holdersSniperPercent` · `holdersInsiderPercent` · `bundlerHoldingPercent` · `newWalletHoldingPercent` · `bnHoldingPercent` · `bnHolders` (long) · `kolHolders` (long) · `proHolders` (long).
+
+**Dev & launch filters:** `devMigrateCountMin/Max` (long) · `devPosition` (`2`=dev sold all) · `devBurnedToken` (`1`=yes) · `excludeDevWashTrading` (`1`=yes) · `excludeInsiderWashTrading` (`1`=yes).
+
+**Other filters:** `protocol` (int[]; see Protocol Reference below) · `exclusive` (`1`=Binance exclusive) · `paidOnDexScreener` · `pumpfunLiving` · `cmcBoost` · `globalFeeMin/Max` (Solana only) · `pairAnchorAddress` (string[]) · `tokenSocials.atLeastOne` (`1`=yes) · `tokenSocials.socials` (string[]: `website` / `twitter` / `telegram`).
+
+### Protocol Reference
+
+Complete list of `protocol` codes (used in `protocol[]` filter and returned on each token).
+
+| Code | Platform | Chain |   | Code | Platform | Chain |
+|---|---|---|---|---|---|---|
+| 1001 | Pump.fun | Solana |  | 1010 | Moonshot | Solana |
+| 1002 | Moonit | Solana |  | 1011 | Jup Studio | Solana |
+| 1003 | Pump AMM | Solana |  | 1012 | Bags | Solana |
+| 1004 | Launch Lab | Solana |  | 1013 | Believer | Solana |
+| 1005 | Raydium V4 | Solana |  | 1014 | Meteora DAMM V2 | Solana |
+| 1006 | Raydium CPMM | Solana |  | 1015 | Meteora Pools | Solana |
+| 1007 | Raydium CLMM | Solana |  | 1016 | Orca | Solana |
+| 1008 | BONK | Solana |  | 2001 | Four.meme | BSC |
+| 1009 | Dynamic BC | Solana |  | 2002 | Flap | BSC |
+
+### Return fields (under `.data[]`)
+
+**Core:**
+
+| Field | Type | Description |
+|---|---|---|
+| `chainId` / `contractAddress` / `symbol` / `name` / `decimals` | — | Identity |
+| `icon` | string | Logo path (prefix `https://bin.bnbstatic.com`) |
+| `price` / `priceChange` | string | Current price (USD), 24h change (%) |
+| `marketCap` / `liquidity` / `volume` | string | USD, string-encoded |
+| `holders` | long | Holder count |
+| `progress` | string | Bonding curve progress — pre-formatted, append `%` directly |
+| `protocol` | integer | Launchpad protocol code |
+| `exclusive` | integer | `1` = Binance exclusive token |
+
+**Trade counts:** `count` / `countBuy` / `countSell` (long, 24h).
+
+**Holder distribution (all string %, append `%` directly):** `holdersTop10Percent` · `holdersDevPercent` · `holdersSniperPercent` · `holdersInsiderPercent` · `bnHoldingPercent` · `kolHoldingPercent` · `proHoldingPercent` · `newWalletHoldingPercent` · `bundlerHoldingPercent`.
+
+**Dev & migration:** `devAddress` · `devSellPercent` · `devMigrateCount` · `devPosition` (`2`=dev sold all) · `migrateStatus` (`0`/`1`) · `migrateTime` · `createTime`.
+
+**Tags & flags:** `tagDevWashTrading` · `tagInsiderWashTrading` · `tagDevBurnedToken` · `tagPumpfunLiving` · `tagCmcBoost` · `paidOnDexScreener` · `launchTaxEnable` · `taxRate` · `globalFee` (Solana only).
+
+**Socials:** `socials.website` / `socials.twitter` / `socials.telegram`.
+
+**AI narrative:** `narrativeText.en` / `narrativeText.cn`.
+
+---
+
+## `topic-rush` — AI-powered hot-topic discovery (GET)
+
+> ⚠️ `rankType`: `10`=Latest (newest hot topics) · `20`=Rising (topics with ATH net-inflow between $1k and $20k).
+> ⚠️ **`sort` default convention:** when the user does not specify a preference, use `sort=10` (create time). `sort=20` = net inflow.
+
+```bash
+node <skill-dir>/scripts/cli.mjs topic-rush '{"chainId":"CT_501","rankType":10,"sort":10,"asc":false}'
+```
+
+### Parameters
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `chainId` | string | **yes** | `"56"` or `"CT_501"` |
+| `rankType` | integer | **yes** | `10`=Latest · `20`=Rising |
+| `sort` | integer | **yes** | `10`=create time (default) · `20`=net inflow |
+| `asc` | boolean | no | `true`=ascending, `false`=descending |
+| `keywords` | string | no | Case-insensitive contains match |
+| `topicType` | string | no | Comma-separated topic-type filter |
+| `tokenSizeMin/Max` | integer | no | Associated-token count range |
+| `netInflowMin/Max` | string | no | Topic net-inflow range (USD) |
+
+### Return fields (under `.data[]`)
+
+**Topic-level:**
+
+| Field | Type | Description |
+|---|---|---|
+| `topicId` | string | Unique topic ID |
+| `chainId` | string | Chain ID |
+| `name.topicNameEn` / `name.topicNameCn` | string | Multi-language topic name |
+| `type` | string | Topic category (e.g. `Culture`) |
+| `close` | integer | `0`=active, `1`=closed |
+| `topicLink` | string | Related tweet / post URL |
+| `createTime` | long | Topic creation timestamp (ms) |
+| `progress` | string | Topic progress — pre-formatted %, append `%` directly |
+| `aiSummary.aiSummaryEn` / `aiSummary.aiSummaryCn` | string | AI-generated narrative |
+| `topicNetInflow` / `topicNetInflow1h` / `topicNetInflowAth` | string | Net inflow: total / 1h / ATH (USD) |
+| `tokenSize` | integer | Number of associated tokens |
+| `deepAnalysisFlag` | integer | `1`=deep analysis available |
+| `topicTags` | string[] | Topic tags (e.g. `Crypto Native`, `Celebrity`) |
+
+**Associated tokens** (`tokenList[]` within each topic):
+
+| Field | Type | Description |
+|---|---|---|
+| `chainId` / `contractAddress` / `symbol` / `decimals` | — | Identity |
+| `icon` | string | Logo path (prefix `https://bin.bnbstatic.com`) |
+| `createTime` | long | Token creation timestamp (ms) |
+| `marketCap` / `liquidity` | string | USD |
+| `priceChange24h` | string | 24h % (pre-formatted) |
+| `netInflow` / `netInflow1h` | string | Net inflow since topic creation / last 1h (USD) |
+| `volumeBuy` / `volumeSell` / `volume1hBuy` / `volume1hSell` | string | Volume breakdown (USD) |
+| `uniqueTrader{5m,1h,4h,24h}` | long | Unique traders by window |
+| `count{5m,1h,4h,24h}` | long | Trade count by window |
+| `holders` / `kolHolders` / `smartMoneyHolders` | long | Holder stats |
+| `protocol` | integer | Launchpad protocol code (`0` / null = DEX token) |
+| `internal` | integer | `1`=on bonding curve |
+| `migrateStatus` | integer | `1`=migrated |
+
+**Nested shape:** each topic has `name: {topicNameEn, topicNameCn}` (and `aiSummary` similarly) plus `tokenList[]` with full per-token stats inline.
+
+---
+
+## Errors
+
+Exit codes: `0` ok · `1` upstream/usage (stderr: reason; stdout: body with business `code`) · `3` network.
+Business `code`: `000000` ok · `100004` rate-limited · `100002` bad param · `000400` token not found / unsupported chain.
+
+---
+
+## Notes
+
+- Percentage fields (`progress`, holder %, `devSellPercent`, `taxRate`, `priceChange24h`) are pre-formatted — append `%` directly, do **not** multiply by 100.
+- `taxRate` visibility: `protocol=2001` (Four.meme) only on Migrated (`rankType=30`); `protocol=2002` (Flap) on all lists.

package/skills/binance-web3/meme-rush/scripts/cli.mjs

@@ -0,0 +1,101 @@
+#!/usr/bin/env node
+import { fileURLToPath } from "url";
+// meme-rush CLI - self-contained, zero-dep, Node >= 22
+// Usage: node cli.mjs <command> '<json_params>'
+//
+// Commands:
+//   meme-rush   POST  Launchpad lifecycle tracking (new / finalizing / migrated)
+//   topic-rush  GET   AI-powered hot-topic discovery with associated tokens
+//
+
+// ---- inline HTTP helper (self-contained, zero dependency) ----
+const TIMEOUT_MS = 10_000;
+const UA = { 'Accept-Encoding': 'identity', 'User-Agent': 'binance-web3/2.0 (Skill)' };
+
+const qs = (p) => Object.entries(p)
+  .filter(([, v]) => v != null)
+  .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)
+  .join('&');
+
+async function call({ url, method = 'GET', body, headers = {} }) {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), TIMEOUT_MS);
+  const opts = { method, headers: { ...UA, ...headers }, signal: ctrl.signal };
+  if (method === 'POST') { opts.headers['content-type'] = 'application/json'; opts.body = JSON.stringify(body || {}); }
+  let res;
+  try { res = await fetch(url, opts); }
+  catch { clearTimeout(timer); throw Object.assign(new Error('Network request failed'), { exitCode: 3 }); }
+  clearTimeout(timer);
+  const data = await res.json();
+  if (res.status >= 400) throw Object.assign(new Error(`HTTP ${res.status}`), { exitCode: 1, body: data });
+  return data;
+}
+
+// ---- per-command supported chains (client-side fail-fast) ----
+const CHAINS = {
+  'meme-rush':  new Set(['56', 'CT_501', '8453']),
+  'topic-rush': new Set(['56', 'CT_501']),
+};
+
+function validateChainId(cmd, chainId) {
+  const allowed = CHAINS[cmd];
+  if (!allowed) return;
+  const id = String(chainId ?? '');
+  if (!allowed.has(id)) {
+    const supported = [...allowed].map((c) => `"${c}"`).join(', ');
+    throw Object.assign(
+      new Error(`${cmd}: unsupported chainId "${chainId}". Supported: ${supported}`),
+      { exitCode: 1 },
+    );
+  }
+}
+
+// ---- commands: (params) => { url, method?, body?, headers? } ----
+const COMMANDS = {
+  'meme-rush': (p) => {
+    validateChainId('meme-rush', p.chainId);
+    return {
+      url: 'https://web3.binance.com/bapi/defi/v1/public/wallet-direct/buw/wallet/market/token/pulse/rank/list/ai',
+      method: 'POST',
+      body: p,
+    };
+  },
+  'topic-rush': (p) => {
+    validateChainId('topic-rush', p.chainId);
+    return {
+      url: `https://web3.binance.com/bapi/defi/v2/public/wallet-direct/buw/wallet/market/token/social-rush/rank/list/ai?${qs(p)}`,
+    };
+  },
+};
+
+// ---- exports (for unit testing; direct execution still works - see dispatch below) ----
+export { COMMANDS, call, qs, UA, TIMEOUT_MS, CHAINS, validateChainId };
+
+// ---- CLI dispatch (only runs when executed directly, not when imported) ----
+if (fileURLToPath(import.meta.url) === process.argv[1]) {
+  const [cmd, paramsStr] = process.argv.slice(2);
+
+  if (!cmd || cmd === '--help' || cmd === '-h') {
+    console.log("Usage: node cli.mjs <command> '<json_params>'\n\nCommands:");
+    for (const name of Object.keys(COMMANDS)) console.log(`  ${name}`);
+    process.exit(0);
+  }
+
+  const builder = COMMANDS[cmd];
+  if (!builder) { console.error(`Unknown command: ${cmd}\nRun with --help to see available commands.`); process.exit(1); }
+
+  let params = {};
+  if (paramsStr) {
+    try { params = JSON.parse(paramsStr); }
+    catch { console.error('Invalid JSON params'); process.exit(1); }
+  }
+
+  try {
+    const result = await call(builder(params));
+    console.log(JSON.stringify(result, null, 2));
+  } catch (err) {
+    console.error(err.message);
+    if (err.body) console.log(JSON.stringify(err.body, null, 2));
+    process.exit(err.exitCode || 1);
+  }
+}

package/skills/binance-web3/query-address-info/SKILL.md

@@ -0,0 +1,61 @@
+---
+name: query-address-info
+description: |
+  Snapshot of a single wallet's token holdings on a specific chain — list of every token currently held with
+  name, symbol, current price, 24h price change, and holding quantity.
+  Use when the user provides an explicit wallet address (or says "my wallet") and wants the current portfolio:
+  "what does 0x... hold", "wallet balance breakdown", "list positions for this address",
+  "what tokens are in this wallet", "show me the holdings of address".
+metadata:
+  author: binance-web3-team
+  version: "2.0"
+---
+
+# Query Address Info Skill
+
+## Overview
+
+This skill queries any on-chain wallet address for token holdings, supporting:
+
+List of all tokens held by a wallet address
+Current price of each token
+24-hour price change percentage
+Holding quantity
+
+## When to Use This Skill
+
+| User intent | Command |
+|-------------|---------|
+| List a wallet's token holdings with price and 24h change | `positions` |
+
+## Supported Chains
+
+| Chain | chainId |
+|-------|---------|
+| BSC | `56` |
+| Solana | `CT_501` |
+| Base | `8453` |
+| Ethereum | `1` |
+
+## How to Call APIs
+
+```bash
+node skill-dir/scripts/cli.mjs positions '{"address":"0x...","chainId":"56","offset":0}'
+```
+
+## Commands
+
+| Command | Purpose | Required args | Example |
+|---------|---------|---------------|---------|
+| `positions` | List wallet token holdings (price + 24h change + quantity) | `address`, `chainId`, `offset` | `node skill-dir/scripts/cli.mjs positions '{"address":"0x...","chainId":"56","offset":0}'` |
+
+## Rules
+
+- **`offset` is required on every call — including the first page.** Pass `0` to fetch the first page; increment for subsequent pages. Omitting it causes an upstream validation error.
+- **Pagination**: repeat with increasing `offset` until `data.list` is empty or shorter than the page size.
+- **Icon URL prefix**: `icon` is a relative path (e.g., `/images/web3-data/public/token/logos/xxxx.png`). Prepend `https://bin.bnbstatic.com` to render.
+- **Numbers as strings**: `price`, `percentChange24h`, `remainQty` are strings — convert to numbers before arithmetic.
+
+## Full CLI Reference
+
+See [`references/cli.md`](references/cli.md) for per-subcommand invocations, parameter tables, return-field tables, and real response samples.

package/skills/binance-web3/query-address-info/references/cli.md

@@ -0,0 +1,56 @@
+# query-address-info — CLI Reference
+
+Complete reference for every command in `scripts/cli.mjs`.
+
+**Invocation pattern:** `node <skill-dir>/scripts/cli.mjs <command> '<json_params>'`
+**Exit codes:** `0` success · `1` usage/upstream error · `3` network failure
+
+---
+
+## `positions` — Wallet active-position list
+
+```bash
+node <skill-dir>/scripts/cli.mjs positions '{"address":"0x...","chainId":"56","offset":0}'
+```
+
+### Parameters
+
+| Param | Type | Required | Description |
+|---|---|---|---|
+| `address` | string | **yes** | Wallet address (EVM `0x...` or Solana base58) |
+| `chainId` | string | **yes** | `"56"` (BSC) · `"8453"` (Base) · `"CT_501"` (Solana) |
+| `offset` | number | **yes** | Pagination offset (start from `0`) |
+
+### Return fields (under `.data.list[]`)
+
+| Field | Type | Description |
+|---|---|---|
+| `chainId` | string | Chain identifier |
+| `address` | string | Queried wallet address (lowercased) |
+| `contractAddress` | string | Token contract address |
+| `binanceTokenId` | string | Binance-internal stable token ID |
+| `name`, `symbol` | string | Token display names |
+| `icon` | string | Logo path — prefix with `https://bin.bnbstatic.com` |
+| `decimals` | number | Token decimals |
+| `price` | string | Current USD price (decimal string) |
+| `percentChange24h` | string | 24h price change (%, signed decimal string) |
+| `baseCoinPrice` | string | USD price of the chain native coin |
+| `remainQty` | string | Holding quantity (human-readable, already divided by decimals) |
+| `circulatingSupply` | string | Circulating supply |
+| `riskLevel`, `riskLevelInt` | string \| null, number | Risk badge (`"LOW"` = 1, etc.); may be `null` |
+| `lowLiquidity` | number | `1` = low-liquidity warning |
+
+### Response envelope (under `.data`)
+
+| Field | Type | Description |
+|---|---|---|
+| `offset` | number | Echo of request offset |
+| `list` | array \| `null` | Position list; `null` when wallet has no tracked holdings |
+| `addressStatus` | any | Reserved (currently always `null`) |
+
+---
+
+## Errors
+
+Exit codes: `0` ok · `1` upstream/usage (stderr: reason; stdout: body with business `code`) · `3` network.
+Business `code`: `000000` ok · `100004` rate-limited · `100002` bad param · `000400` unsupported chain / bad address.

package/skills/binance-web3/query-address-info/scripts/cli.mjs

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+import { fileURLToPath } from "url";
+// query-address-info CLI - self-contained, zero-dep, Node >= 22
+// Usage: node cli.mjs <command> '<json_params>'
+//
+// Commands:
+//   positions  GET  wallet active-position list (token balances + 24h price change)
+//
+
+// ---- inline HTTP helper (self-contained, zero dependency) ----
+const TIMEOUT_MS = 10_000;
+const UA = { 'Accept-Encoding': 'identity', 'User-Agent': 'binance-web3/2.0 (Skill)' };
+
+const qs = (p) => Object.entries(p)
+  .filter(([, v]) => v != null)
+  .map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`)
+  .join('&');
+
+async function call({ url, method = 'GET', body, headers = {} }) {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), TIMEOUT_MS);
+  const opts = { method, headers: { ...UA, ...headers }, signal: ctrl.signal };
+  if (method === 'POST') { opts.headers['content-type'] = 'application/json'; opts.body = JSON.stringify(body || {}); }
+  let res;
+  try { res = await fetch(url, opts); }
+  catch { clearTimeout(timer); throw Object.assign(new Error('Network request failed'), { exitCode: 3 }); }
+  clearTimeout(timer);
+  const data = await res.json();
+  if (res.status >= 400) throw Object.assign(new Error(`HTTP ${res.status}`), { exitCode: 1, body: data });
+  return data;
+}
+
+// ---- supported chains (client-side fail-fast) ----
+const SUPPORTED_CHAINS = new Set(['1', '56', '8453', 'CT_501']);
+
+function validateChainId(chainId) {
+  const id = String(chainId ?? '');
+  if (!SUPPORTED_CHAINS.has(id)) {
+    const supported = [...SUPPORTED_CHAINS].map((c) => `"${c}"`).join(', ');
+    throw Object.assign(
+      new Error(`positions: unsupported chainId "${chainId}". Supported: ${supported}`),
+      { exitCode: 1 },
+    );
+  }
+}
+
+// Client-side fail-fast for malformed addresses.
+const EVM_CHAINS = new Set(['1', '56', '8453']);
+const SOLANA_CHAIN = 'CT_501';
+const EVM_ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
+const SOLANA_ADDRESS_RE = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
+const EVM_ZERO = '0x' + '0'.repeat(40);
+
+function validationError(msg) {
+  return Object.assign(new Error(msg), { exitCode: 1 });
+}
+
+function validateAddress(address, chainId) {
+  if (typeof address !== 'string' || address.length === 0) {
+    throw validationError('address is required');
+  }
+  // Reject whitespace, control chars, URL-encoded sequences (CRLF injection guard).
+  if (/\s/.test(address) || /[\x00-\x1f\x7f]/.test(address) || /%/.test(address)) {
+    throw validationError('address contains invalid characters (whitespace / control / %-encoded)');
+  }
+  // Reject non-ASCII (rejects unicode look-alikes and multibyte chars).
+  if (/[^\x20-\x7e]/.test(address)) {
+    throw validationError('address contains non-ASCII characters');
+  }
+
+  const chain = String(chainId ?? '');
+  if (EVM_CHAINS.has(chain)) {
+    if (!EVM_ADDRESS_RE.test(address)) {
+      throw validationError(`invalid EVM address for chainId=${chain}: expected 0x + 40 hex chars`);
+    }
+    if (address.toLowerCase() === EVM_ZERO) {
+      throw validationError('zero address (0x000...000) is not a valid wallet');
+    }
+    return;
+  }
+  if (chain === SOLANA_CHAIN) {
+    if (!SOLANA_ADDRESS_RE.test(address)) {
+      throw validationError('invalid Solana address: expected base58, 32-44 chars');
+    }
+    return;
+  }
+  // Unknown chain - let upstream decide.
+}
+
+// ---- commands: (params) => { url, method?, body?, headers? } ----
+const COMMANDS = {
+  positions: (p) => {
+    validateChainId(p.chainId);
+    validateAddress(p.address, p.chainId);
+    return {
+      url: `https://web3.binance.com/bapi/defi/v3/public/wallet-direct/buw/wallet/address/pnl/active-position-list/ai?${qs(p)}`,
+      headers: { clienttype: 'web', clientversion: '1.2.0' },
+    };
+  },
+};
+
+// ---- exports (for unit testing; direct execution still works - see dispatch below) ----
+export { COMMANDS, call, qs, UA, TIMEOUT_MS, validateAddress, validateChainId, SUPPORTED_CHAINS };
+
+// ---- CLI dispatch (only runs when executed directly, not when imported) ----
+if (fileURLToPath(import.meta.url) === process.argv[1]) {
+  const [cmd, paramsStr] = process.argv.slice(2);
+
+  if (!cmd || cmd === '--help' || cmd === '-h') {
+    console.log("Usage: node cli.mjs <command> '<json_params>'\n\nCommands:");
+    for (const name of Object.keys(COMMANDS)) console.log(`  ${name}`);
+    process.exit(0);
+  }
+
+  const builder = COMMANDS[cmd];
+  if (!builder) { console.error(`Unknown command: ${cmd}\nRun with --help to see available commands.`); process.exit(1); }
+
+  let params = {};
+  if (paramsStr) {
+    try { params = JSON.parse(paramsStr); }
+    catch { console.error('Invalid JSON params'); process.exit(1); }
+  }
+
+  try {
+    const result = await call(builder(params));
+    console.log(JSON.stringify(result, null, 2));
+  } catch (err) {
+    console.error(err.message);
+    if (err.body) console.log(JSON.stringify(err.body, null, 2));
+    process.exit(err.exitCode || 1);
+  }
+}

package/skills/binance-web3/query-token-audit/SKILL.md

@@ -0,0 +1,162 @@
+---
+name: query-token-audit
+description: |
+  Query token security audit to detect scams, honeypots, and malicious contracts before trading.
+  Returns comprehensive security analysis including contract risks, trading risks, and scam detection.
+  Use when users ask "is this token safe?", "check token security", "audit token", or before any swap.
+metadata:
+  author: binance-web3-team
+  version: "1.4"
+---
+
+# Query Token Audit Skill
+
+## Overview
+
+| API | Function            | Use Case |
+|-----|---------------------|----------|
+| Token Security Audit | Token security scan | Detect honeypot, rug pull, scam, malicious functions |
+
+## Use Cases
+
+1. **Pre-Trade Safety Check**: Verify token security before buying or swapping
+2. **Scam Detection**: Identify honeypots, fake tokens, and malicious contracts
+3. **Contract Analysis**: Check for dangerous ownership functions and hidden risks
+4. **Tax Verification**: Detect unusual buy/sell taxes before trading
+
+## Supported Chains
+
+| Chain Name | chainId |
+|------------|---------|
+| BSC | 56 |
+| Base | 8453 |
+| Solana | CT_501 |
+| Ethereum | 1 |
+
+---
+
+## API: Token Security Audit
+
+### Method: POST
+
+**URL**: 
+```
+https://web3.binance.com/bapi/defi/v1/public/wallet-direct/security/token/audit
+```
+
+**Request Parameters**:
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| binanceChainId | string | Yes | Chain ID: `CT_501` (Solana), `56` (BSC), `8453` (Base), `1` (Ethereum) |
+| contractAddress | string | Yes | Token contract address |
+| requestId | string | Yes | Unique request ID (UUID v4 format) |
+
+**Request Headers**:
+```
+Content-Type: application/json
+Accept-Encoding: identity
+User-Agent: binance-web3/1.4 (Skill)
+```
+
+**Example Request**:
+```bash
+curl --location 'https://web3.binance.com/bapi/defi/v1/public/wallet-direct/security/token/audit' \
+--header 'Content-Type: application/json' \
+--header 'source: agent' \
+--header 'Accept-Encoding: identity' \
+--header 'User-Agent: binance-web3/1.4 (Skill)' \
+--data '{
+    "binanceChainId": "56",
+    "contractAddress": "0x55d398326f99059ff775485246999027b3197955",
+    "requestId": "'$(uuidgen)'"
+}'
+```
+
+**Response Example**:
+```json
+{
+    "code": "000000",
+    "data": {
+        "requestId": "d6727c70-de6c-4fad-b1d7-c05422d5f26b",
+        "hasResult": true,
+        "isSupported": true,
+        "riskLevelEnum": "LOW",
+        "riskLevel": 1,
+        "extraInfo": {
+            "buyTax": "0",
+            "sellTax": "0",
+            "isVerified": true
+        },
+        "riskItems": [
+            {
+                "id": "CONTRACT_RISK",
+                "name": "Contract Risk",
+                "details": [
+                    {
+                        "title": "Honeypot Risk Not Found",
+                        "description": "A honeypot is a token that can be bought but not sold",
+                        "isHit": false,
+                        "riskType": "RISK"
+                    }
+                ]
+            }
+        ]
+    },
+    "success": true
+}
+```
+
+**Response Fields**:
+
+| Field                             | Type | Description                                               |
+|-----------------------------------|------|-----------------------------------------------------------|
+| hasResult                         | boolean | Whether audit data is available                           |
+| isSupported                       | boolean | Whether the token is supported for audit                  |
+| riskLevelEnum                     | string | Risk level: `LOW`, `MEDIUM`, `HIGH`                       |
+| riskLevel                         | number | Risk level number (1-5)                                   |
+| extraInfo.buyTax                  | string | Buy tax percentage (null if unknown)                      |
+| extraInfo.sellTax                 | string | Sell tax percentage (null if unknown)                     |
+| extraInfo.isVerified              | boolean | Whether contract code is verified                         |
+| riskItems[].id                    | string | Risk category: `CONTRACT_RISK`, `TRADE_RISK`, `SCAM_RISK` |
+| riskItems[].details[].title       | string | Risk check title                                          |
+| riskItems[].details[].description | string | Risk check description                                    |
+| riskItems[].details[].isHit       | boolean | true = risk detected                                      |
+| riskItems[].details[].riskType    | string | `RISK` (critical) or `CAUTION` (warning)                  |
+
+**Risk Level Reference**:
+
+| riskLevel | riskLevelEnum | Action | Description |
+|-----------|---------------|--------|-------------|
+| 0-1 | LOW | Proceed with caution | Lower risk detected, but NOT guaranteed safe. DYOR. |
+| 2-3 | MEDIUM | Exercise caution | Moderate risks detected, review risk items carefully |
+| 4 | HIGH | Avoid trading | Critical risks detected, high probability of loss |
+| 5 | HIGH | Block transaction | Severe risks confirmed, do NOT proceed |
+
+**IMPORTANT**: LOW risk does NOT mean "safe." Audit results are point-in-time snapshots. Project teams can modify contracts or restrict liquidity after purchase. These risks cannot be predicted in advance.
+
+**Response Handling**:
+
+- If `hasResult=false` OR `isSupported=false`:
+  → Reply: "Security audit data is not available for this token on this chain."
+  → Do NOT show `riskLevel`, `riskLevelEnum`, or `riskItems` (data is unreliable when either field is false)
+  → You may suggest the user verify the contract address and chain, or try again later
+- If `hasResult=true` AND `isSupported=true`:
+  → Show the full audit result including risk level, tax info, and all risk items
+  → Apply the Risk Level Reference table above for actionable guidance
+
+---
+
+## User Agent Header
+
+Include `User-Agent` header with the following string: `binance-web3/1.4 (Skill)`
+
+## Notes
+
+1. All numeric fields are string format, convert when using
+2. Audit results are ONLY valid when `hasResult: true` AND `isSupported: true`
+3. `riskLevel: 5` means transaction should be blocked; `riskLevel: 4` is high risk
+4. Tax thresholds: >10% is critical, 5-10% is warning, <5% is acceptable
+5. Generate unique UUID v4 for each audit request
+6. Only output security check risk flags, do NOT provide any investment advice 
+7. Always end with disclaimer: `⚠️ This audit result is for reference only and does not constitute investment advice. Always conduct your own research.`