Requirements
- Target platform
- OpenClaw
- Install method
- Manual import
- Extraction
- Extract archive
- Prerequisites
- OpenClaw
- Primary doc
- SKILL.md
Real-time cryptocurrency scam detection with database-first architecture. Protects users from phishing, honeypots, rug pulls, and ponzi schemes. No external...
Real-time cryptocurrency scam detection with database-first architecture. Protects users from phishing, honeypots, rug pulls, and ponzi schemes. No external...
Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.
I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete.
I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run.
Database-first cryptocurrency scam detection for OpenClaw Analyzes crypto addresses for phishing, honeypots, rug pulls, and ponzi schemes using a local database with background sync from Etherscan. Zero external API calls during user checks = instant results!
β Database-first design - All checks query local SQLite database β Instant results - No API latency during checks (<5ms) β No rate limits - User queries never hit Etherscan API β Background sync worker - Separate process pulls from Etherscan β Transaction message analysis - Decodes and analyzes hex data β Auto-queue system - Unknown addresses automatically queued for sync β Deep scanning - Detects suspicious keywords in transaction data
Now catches scams the old version missed: β "Lazarus Vanguard" hacking group references β "Orbit Bridge Hacker" mentions β Private key phishing attempts β Exploit recruitment messages β And much more...
crypto-scam-detector/ βββ SKILL.md # This file βββ DATABASE_ARCHITECTURE.md # Technical documentation βββ database.py # SQLite database layer βββ crypto_check_db.py # Database-only checker (instant) βββ sync_worker.py # Background Etherscan sync worker βββ secure_key_manager.py # Encrypted API key storage βββ install.sh # Auto-installer βββ setup.sh # API key setup wizard βββ check_address.sh # Convenience script (sync if needed) βββ requirements.txt # Python dependencies βββ venv/ # Virtual environment (created on install)
cd ~/.openclaw/workspace/skills/crypto-scam-detector bash install.sh
Option A: Interactive Setup (Encrypted storage) ./setup.sh # Follow the wizard to encrypt your API key Option B: Environment Variable export ETHERSCAN_API_KEY="your_key_here" Get free API key: https://etherscan.io/myapikey
# Check address (instant, database-only) python3 crypto_check_db.py 0x1234567890abcdef1234567890abcdef12345678
Manual mode: python3 sync_worker.py # Runs continuously, processes queue Batch mode: python3 sync_worker.py --max-jobs 20 # Process 20 addresses then exit Cron schedule (recommended): # Add to crontab */10 * * * * cd ~/.openclaw/workspace/skills/crypto-scam-detector && source venv/bin/activate && ETHERSCAN_API_KEY="key" python3 sync_worker.py --max-jobs 30
User checks address β ββββββββββββββββββββ β crypto_check_db β β Queries local database ONLY ββββββββββ¬ββββββββββ (No external API calls) β β ββββββββββββββββββββββββ β Local SQLite DB β β ~/.config/crypto- β β scam-detector/ β β β β β’ Addresses β β β’ Transactions β β β’ Risk scores β β β’ Scam indicators β β β’ Sync queue β ββββββββββ²ββββββββββββββ β β Background sync β ββββββββββ΄ββββββββββββββ β sync_worker.py β β Pulls from Etherscan β β (Uses your API key) β β’ Reads queue β β β’ Calls Etherscan β β β’ Decodes TX data β β β’ Analyzes messages β β β’ Stores in DB β ββββββββββββββββββββββββ
Check address: python3 crypto_check_db.py 0x... If in database: Instant results with full analysis If NOT in database: Returns "unknown" status Automatically adds to sync queue Shows: "β³ Check again in a few minutes" Background worker syncs it (next cron run or manual trigger) Check again: Full analysis now available
TypeDetection MethodPhishingKeyword analysis: "private key", "seed phrase", "verify wallet"HoneypotContract code analysis (unverified contracts)Rug PullTransaction pattern analysisExploit GroupsKeywords: "Lazarus", "hack", "exploit", "breach"Social EngineeringKeywords: "urgent", "claim reward", "airdrop winner"
Algorithm factors: Suspicious transaction count (+25 per TX, max +50) Account age (new addresses: +10) Balance patterns (large balance + suspicious TX: +20) Contract verification (unverified: +30) Risk Levels: 0-19: β Low Risk 20-49: βΉοΈ Medium Risk 50-79: β οΈ High Risk 80-100: π¨ Critical Risk
# Human-readable output python3 crypto_check_db.py 0x... # JSON output python3 crypto_check_db.py 0x... --json
# Add address to queue python3 sync_worker.py --add-address 0x... # Run worker (continuous) python3 sync_worker.py # Process N addresses then stop python3 sync_worker.py --max-jobs 20 # Custom delay between addresses python3 sync_worker.py --delay 2.0 # Show database stats python3 sync_worker.py --stats
# Check and auto-sync if needed ./check_address.sh 0x... # Automatically syncs if not in DB, then shows results
π¨ Analysis for 0x098b716b8aaf21512996dc57eb0615e2383e2f96 Risk Score: 100/100 - CRITICAL RISK Last Updated: 2026-02-20 07:14:32 π¨ KNOWN SCAM DETECTED! βοΈ Smart Contract β οΈ NOT VERIFIED on Etherscan Transactions: 38 Balance: 101.802430 ETH π¨ 5 Scam Indicator(s) Detected: β’ Suspicious keyword detected: 'lazarus' (confidence: 80%) β’ Suspicious keyword detected: 'hack' (confidence: 80%) β’ Suspicious keyword detected: 'exploit' (confidence: 80%) β’ Suspicious keyword detected: 'private key' (confidence: 80%) β οΈ 5 Suspicious Transaction(s): β’ 0x74f7fbfe5a0bd3... Reason: Suspicious keyword detected: 'lazarus' Message: "Greetings Lazarus Vanguard..." π Recommendations: π« DO NOT send funds to this address β οΈ This address has been flagged as high risk π Report the source that gave you this address
β³ Analysis for 0xnew_address_not_in_db Risk Score: 0/100 - UNKNOWN Last Updated: N/A β³ Address not yet in database Address not in database. Added to sync queue. π Recommendations: β³ This address will be analyzed soon π Check again in a few minutes β οΈ Exercise caution until analysis completes
Default: ~/.config/crypto-scam-detector/crypto_data.db
Free tier: 5 calls/second, 100,000 calls/day Each address: 4 API calls (balance, TX count, TX list, code) Default delay: 1.5 seconds between addresses (safe for free tier)
# Every 10 minutes, process 30 addresses */10 * * * * cd ~/.openclaw/workspace/skills/crypto-scam-detector && source venv/bin/activate && ETHERSCAN_API_KEY="key" python3 sync_worker.py --max-jobs 30 --delay 2.0 # Handles ~4,320 addresses per day
β Encrypted API key storage - AES-256 with PBKDF2 β No third-party sharing - API key only sent to Etherscan β Local processing - All analysis happens on your machine β No telemetry - Zero data collection β Open source - Fully auditable code
addresses - Address info, risk scores, balances, metadata transactions - Suspicious transactions with decoded messages scam_indicators - Individual red flags per address sync_queue - Addresses waiting to be synced See DATABASE_ARCHITECTURE.md for full technical details.
Default behavior: First check β address queued for sync Worker processes queue (manual or cron) Subsequent checks β instant from database Recommended: Run worker via cron every 5-10 minutes
"Check if 0x1234... is a scam" "Is this address safe: 0xabc..." "Verify 0xdef... before I send ETH"
When you check an address, OpenClaw: Runs crypto_check_db.py If not in DB β queues for sync Returns current status Suggests checking again after sync
Solution: Wait for background worker to sync it, or manually trigger: python3 sync_worker.py --add-address 0x... python3 sync_worker.py --max-jobs 1
Solution: Set API key via environment or setup wizard: ./setup.sh # or export ETHERSCAN_API_KEY="your_key"
Solution: Increase delay between addresses: python3 sync_worker.py --delay 3.0
β Check latency: <5ms (database query) β Sync time: ~2 seconds per address (4 API calls) β Database size: ~1KB per address β Capacity: Handles millions of addresses
Featurev1.1.3 (Old)v2.0.0 (New)Check speed2-5 seconds (API calls)<5ms (database)Rate limitsYes (every check)No (checks only query DB)TX message analysisβ Not analyzedβ Fully analyzedFalse negativesHigh (missed scams)Low (deep analysis)ArchitectureDirect API callsDatabase + background workerAPI key usageEvery checkOnly background worker
MIT License - Free and open source
GitHub: https://github.com/trustclaw/crypto-scam-detector Issues: Report bugs or request features ClawHub: https://clawhub.com/crypto-scam-detector Hackathon: NeoClaw Hackathon 2026
Developed by Trust Claw Team for NeoClaw Hackathon 2026 Built with: SQLite - Local database Etherscan API - Blockchain data ChainAbuse API - Community scam reports Python asyncio - Async operations π Stay safe in crypto! Always verify addresses before sending funds.
Agent frameworks, memory systems, reasoning layers, and model-native orchestration.
Largest current source with strong distribution and engagement signals.