token-integration-analyzer

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, blockchain, security, smart-contracts, tokens.

What it does

Token integration and implementation analyzer based on Trail of Bits' token integration checklist. Analyzes token implementations for ERC20/ERC721 conformity, checks for 20+ weird token patterns, assesses contract composition and owner privileges, performs on-chain scarcity analysis, and evaluates how protocols handle non-standard tokens. Use when integrating or accepting arbitrary ERC20/ERC721 tokens, auditing a token implementation for standards conformity, or assessing risk from weird tokens such as fee-on-transfer, rebasing, missing return values, or blocklists.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill token-integration-analyzer

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/building-secure-contracts/skills/token-integration-analyzer ~/.claude/skills/token-integration-analyzer

Safety box score

Grade B, low risk: 11 of 100 risk points, rated 2026-10-20. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is a documentation-only skill for analyzing ERC20/ERC721 token implementations and protocols that integrate tokens. Its main exposure is limited local analysis tooling plus optional read-only on-chain queries via a user-provided RPC endpoint; it does not ship scripts, binaries, or destructive actions.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	The skill directs the agent to run local analysis tools such as `slither-check-erc`, `slither --print human-summary`, `slither --print contract-summary`, and `slither-prop`.
Network access	1 (low)	It can query deployed contracts and chain state with `web3.js`/`ethers.js` when given a contract address and RPC endpoint, so it may send read-only requests to external nodes.
Filesystem reach	1 (low)	The skill is meant to inspect the codebase in the working tree for token and integration risks, but it does not instruct writes or deletes outside the project.
Secrets & credentials	0 (none)	No credential stores, browser sessions, key files, or secret-pasting workflow is described; the inputs mentioned are contract addresses and an RPC endpoint.
Privilege & persistence	0 (none)	There is no request for sudo, global installs, services, shell startup edits, or other OS-level privilege changes.
Instruction hijack surface	0 (none)	The shipped files contain no prompt-injection payloads, hidden text, or instructions to ignore safeguards.
Irreversible actions	0 (none)	The skill is analytical only; it produces reports and recommendations rather than publishing, deploying, paying, or deleting anything.
Transparency	0 (none)	All shipped files are plain text or SVG and fully readable; there are no binaries, base64 blobs, or downloaded installers.

Before installing

Read `SKILL.md` and confirm you want the agent to run local Slither commands in your repo.
If you plan to use on-chain analysis, provide only a read-only RPC endpoint you are comfortable exposing.
Check whether your project contains any token integration tests or contracts you do not want the agent to inspect.

Rated 2026-10-20 by an automated review of 5 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/building-secure-contracts/skills/token-integration-analyzer/SKILL.md
Branch: main
Collection: building-secure-contracts
Updated: 2026-09-19

algorand-vulnerability-scanner — Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations.
cairo-vulnerability-scanner — Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems.
cosmos-vulnerability-scanner — Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence.
solana-vulnerability-scanner — Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing.
substrate-vulnerability-scanner — Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks.
ton-vulnerability-scanner — Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts.