x402-wach — DeFi Risk Analysis

A DeFi risk analysis toolkit powered by WACH.AI, using x402 with AWAL-managed key custody.

OpenClaw Hard Rules (Non-Negotiable)

When this skill is active, OpenClaw must follow all rules below:

1. Never request or expose secrets

   • Never ask for private keys, seed phrases, mnemonics, wallet export files, or raw signing material.
   • Never suggest using

     wallet.json

     or any local key file flow.

2. AWAL-only custody path

   • Always use AWAL-backed commands for setup and payments.
   • Treat legacy local-wallet instructions as invalid for this skill version.

3. Run readiness checks before paid calls

   • Before

     verify-risk

     , ensure AWAL is ready via

     wallet setup

     or

     wallet doctor

     .
   • If not ready, stop and guide user to login/fund flow.

4. Respect payment guardrails

   • Default max payment cap is

     10000

     atomic USDC (

     $0.01

     ) per request.
   • Do not raise cap unless the user explicitly asks.

5. Do not hide payment failure details

   • If payment fails, surface clear reason and next action (auth, balance, network, command mismatch).
   • Do not claim success unless report payload is actually present.

6. No blind retries that may duplicate spend

   • For network/transient errors, retry once at most.
   • Keep the same request context and tell the user a retry was attempted.

7. Always present source link in final report

   • Prefer TokenSense URL pattern:

     • https://tokensense.wach.ai/<chain>/<tokenAddress>

   • Use API source only as fallback.

When to Use This Skill

Use this skill when user asks to:

• assess DeFi risk for a token
• detect scam/honeypot patterns
• inspect holder concentration/liquidity quality
• review contract risk signals
• get risk/market/code score breakdown
• evaluate tokens across

  eth

  ,

  pol

  ,

  base

  ,

  bsc

  , or

  sol

Supported Chains

eth

pol

base

bsc

sol

Payment is always in USDC on Base, regardless of analysis chain.

Command Playbook for OpenClaw

1) Readiness / Setup

Run:

x402-wach wallet setup

If setup says not ready, run:

x402-wach wallet doctor
x402-wach wallet login <EMAIL>
x402-wach wallet verify <FLOW_ID> <OTP>
x402-wach wallet balance

Interpretation:

• ✓ Ready to make x402 payments with AWAL

  -> proceed to analysis.

• AWAL wallet is not authenticated

  -> run login + verify flow.

• Insufficient USDC on Base

  -> ask user to fund AWAL address.

• Could not read AWAL balance/status

  -> run doctor and show raw failure.

2) Risk Analysis

Run:

x402-wach verify-risk <TOKEN_ADDRESS> <CHAIN_SHORT_NAME>

Preferred cap-safe form:

x402-wach verify-risk <TOKEN_ADDRESS> <CHAIN_SHORT_NAME> --max-amount-atomic 10000

3) Optional Helpers

x402-wach wallet status
x402-wach wallet address
x402-wach chains
x402-wach guide

Tool Result Interpretation Rules

Readiness/Doctor Output

• Contains

  ✓ Ready

  -> safe to proceed with paid analysis.
• Contains

  not authenticated

  -> require OTP login/verify.
• Contains

  Insufficient USDC

  -> request wallet funding on Base.
• Contains command-help text from AWAL -> command mismatch/version issue; run

  x402-wach wallet doctor

  and use supported subcommands shown.
• Contains JSON parse errors -> treat as AWAL output format mismatch; surface raw error and do not continue paid flow.

verify-risk Output

• Token analysis complete!

  + populated sections -> success.
• Header only with empty body -> payload unwrap issue; report as tool parsing bug.

• No token found

  / empty report -> valid call, no token at address/chain.
• 402/payment error -> wallet balance/cap/auth issue; user action required.

Safety-Focused User Guidance

When blocked, provide this exact short path:

x402-wach wallet doctor
x402-wach wallet login <email>
x402-wach wallet verify <flowId> <otp>
x402-wach wallet balance

Then retry:

x402-wach verify-risk <TOKEN_ADDRESS> <CHAIN_SHORT_NAME> --max-amount-atomic 10000

Programmatic Usage Pattern (Agent-Friendly)

import {
  getAwalReadiness,
  validateTokenAddress,
  verifyTokenRisk,
} from "@quillai-network/x402-wach";

const token = "0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48";
const chain = "eth";

const validation = validateTokenAddress(token, chain);
if (!validation.valid) throw new Error(validation.error);

const readiness = await getAwalReadiness(10_000);
if (!readiness.ready) throw new Error(readiness.reasons.join("; "));

const report = await verifyTokenRisk(token, chain, { maxAmountAtomic: 10_000 });
console.log(report);

Expected Report Sections

On successful analysis, formatted output can include:

• Market Data
• Risk Scores
• Honeypot Analysis
• Holders
• Liquidity
• Code Analysis
• Social & Community
• Source (TokenSense link) + report timestamp

Absolute Prohibitions for OpenClaw

• Do not use or suggest

  wallet create

  ,

  wallet import

  , or

  wallet.json

  .
• Do not ask user for private key or seed phrase.
• Do not increase spend cap silently.
• Do not claim analysis success when output parsing failed.
• Do not suppress AWAL raw errors when diagnosis is needed.