{"id":"24003576-12f0-42ce-98de-c45f341db0a6","repo":"anoncf/aikol","status":"done","verdict":"no_red_flags","headline":"No red flags found. README claims backed by the code: 1 of 8.","error":null,"report":{"ai":{"kind":"agent","claims":[{"claim":"Collective of autonomous agent KOLs that provide memecoin alpha","verdict":"partial","evidence":"Only one character file (characters/aikollea.character.json) exists. No multi-agent 'collective' or DAO logic is in the visible code; it is the standard Eliza runtime."},{"claim":"Analyzes real-time crypto news via CryptoPanic with Playwright content extraction and memory storage","verdict":"partial","evidence":"packages/client-news and packages/plugin-news exist and are wired in (agent/src/index.ts:402, 492), and CRYPTOPANIC_API_KEY is in .env.example. Their implementation files were not in the excerpts, so Playwright/CAPTCHA handling was not reviewed."},{"claim":"Token and wallet analysis via the TopWallets API (metrics, scoring, risk assessment)","verdict":"partial","evidence":"packages/plugin-analysis registers scanToken and scanWallet actions (src/index.ts:12) and TOPWALLETS_API_* are in .env.example; the action code was not shown."},{"claim":"Built on Eliza and trained with expert memecoin guides","verdict":"partial","evidence":"The Eliza framework is clearly the base (packages/core, @ai16z/eliza). 'Trained' presumably means knowledge in the character file, which was not reviewed; no model training code exists."},{"claim":"Engages on X (Twitter) and Telegram","verdict":"supported","evidence":"packages/client-twitter/src/index.ts and packages/client-telegram/src/index.ts, started from agent/src/index.ts:364-378."},{"claim":"Enhanced Twitter client generating news-based tweets from memory","verdict":"partial","evidence":"The client-twitter package exists with post.ts, but the news-specific modifications were not visible in the excerpts."},{"claim":"Provides top-tier memecoin alpha without scams, dumps, or manipulation","verdict":"unverifiable","evidence":"Output quality and the agent's conflicts of interest cannot be shown by code. The agent also has Solana swap/pumpfun/DAO-swap actions (plugin-solana/src/index.ts:24-31), so its trading behavior is not constrained by the code."},{"claim":"Copytrading: follow top-performing wallets with ease","verdict":"unsupported","evidence":"No copytrade action is visible. Only scanWallet/scanToken in plugin-analysis, plus a generic take_order action in plugin-solana. The README itself lists trading delegation as future work."}],"costUsd":0.177318,"summary":"This is a fork of the ai16z/Eliza agent framework, customized as 'aiKOL' with an added news client (CryptoPanic), a news plugin, an analysis plugin (token/wallet scanning via TopWallets), and a Twitter client change. The agent runtime loads a character (aikollea.character.json), connects to Twitter/Telegram/Discord/etc., and has many optional wallet plugins (Solana swaps, EVM, Coinbase trading) that can move funds when private keys are configured. The aiKOL-specific modules exist in the tree but their source was not included in the excerpts, so the 'alpha' claims could only be checked at the wiring level.","capabilities":[{"evidence":"agent/src/index.ts:114-210, 313-340, 584-637","capability":"Loads character JSON files, builds an AgentRuntime with DB (Postgres/SQLite) and cache, and starts configured clients"},{"evidence":"agent/src/index.ts:491-494; packages/plugin-news/src/index.ts:6-12; packages/plugin-analysis/src/index.ts:8-15","capability":"Registers the custom news and analysis plugins unconditionally for every agent"},{"evidence":"agent/src/index.ts:402-405; packages/client-news/src/index.ts:4-23","capability":"Starts a news client when 'news' is listed in the character's clients"},{"evidence":"agent/src/index.ts:354-405; packages/client-twitter/src/index.ts:8-55","capability":"Twitter, Telegram, Discord, Farcaster, Lens and Slack clients that let the agent post and reply autonomously"},{"evidence":"agent/src/index.ts:495-561; packages/plugin-solana/src/index.ts:21-34","capability":"Conditionally enables on-chain action plugins that can sign and send transactions (Solana swap/pumpfun/transfer, EVM, Coinbase trade, etc.) based on which private keys are set"},{"evidence":"packages/client-direct/src/index.ts:60-297","capability":"REST API (DirectClient) with message, image, whisper and fine-tune endpoints, with open CORS and no authentication visible"},{"evidence":"packages/client-direct/src/index.ts:190-233","capability":"Per-message LLM response generation, then action and evaluator processing"},{"evidence":"packages/client-github/src/index.ts:52-180","capability":"GitHub client that clones a repo, ingests files as knowledge, and can push commits and PRs"}],"findingReviews":[]},"url":"https://github.com/anoncf/aikol","depth":"standard","stats":{"files":1603,"binaries":22,"textFiles":1580,"truncated":false},"verdict":"no_red_flags","findings":[{"id":"bait.file_host","title":"Links to a file-sharing or link-shortening site","detail":"Downloads routed through file hosts or shortened links can't be checked and are a common way to deliver malware.","evidence":[{"line":18,"path":"docs/community/Discord/the_arena/memes-and-marketing/chat_2024-10-27.md","excerpt":"…k to a Google Drive folder where relevant files are stored: https://drive.google.com/drive/folders/1LtDR4JJPoQIbn2Vd_pN73aECv7lgcTY8?usp=sharing…"},{"line":8,"path":"docs/community/Discord/the_arena/memes-and-marketing/chat_2024-10-29.md","excerpt":"- [whobody]: You can download the data from this Google Drive link: https://drive.google.com/drive/folders/1LtDR4JJPoQIbn2Vd_pN73aECv7lgcTY8?usp=sharing"}],"severity":"info"},{"id":"install.npm_hook","title":"Runs code automatically on install (preinstall)","detail":"npm runs this as soon as someone installs the package: \"npx only-allow pnpm\".","evidence":[{"path":"package.json"}],"severity":"info"},{"id":"install.npm_hook","title":"Runs code automatically on install (postinstall)","detail":"npm runs this as soon as someone installs the package: \"node scripts/postinstall.js\".","evidence":[{"path":"packages/client-news/package.json"},{"path":"packages/plugin-node/package.json"}],"severity":"info"},{"id":"install.pipe_to_shell","title":"Install command pipes a download straight into a shell","detail":"Common for installers, but it runs whatever the server sends. Make sure the domain is the project's own.","evidence":[{"line":13,"path":"docs/docs/guides/docker-setup.md","excerpt":"curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.1/install.sh | bash"},{"line":25,"path":"docs/docs/guides/docker-setup.md","excerpt":"curl -fsSL https://get.pnpm.io/install.sh | sh -"},{"line":46,"path":"docs/docs/guides/wsl.md","excerpt":"curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash"},{"line":54,"path":"docs/docs/guides/wsl.md","excerpt":"curl -fsSL https://get.pnpm.io/install.sh | sh -"}],"severity":"info"},{"id":"deps.off_registry","title":"Some dependencies come from git or a custom address","detail":"Common in monorepos and forks, but these packages skip the registry's checks. Worth a look if the project handles keys.","evidence":[{"line":10,"path":"packages/client-discord/package.json","excerpt":"@discordjs/opus → github:discordjs/opus"},{"line":542,"path":"pnpm-lock.yaml","excerpt":"31da49d8d2cc6c5a2ab1bfd332033ff7d5f9fb02 → https://codeload.github.com/discordjs/opus/tar.gz/31da49d8d2cc6c5a2ab1bfd332033ff7d5f9fb02"}],"severity":"info"},{"id":"keys.handles_private_keys","title":"Handles wallet private keys or seed phrases","detail":"Expected for agents that sign transactions. The keys should stay on your machine and only be used to sign.","evidence":[{"line":520,"path":"agent/src/index.ts","excerpt":"getSecret(character, \"SOLANA_PRIVATE_KEY\") &&"},{"line":29,"path":"packages/plugin-conflux/src/actions/bridgeTransfer.ts","excerpt":"secretKey: `0x${string}`,"},{"line":21,"path":"packages/plugin-conflux/src/actions/transfer.ts","excerpt":"secretKey: `0x${string}`,"},{"line":58,"path":"packages/plugin-multiversx/src/providers/wallet.ts","excerpt":"const secretKey = UserSecretKey.fromString(privateKey);"},{"line":82,"path":"packages/plugin-near/src/actions/swap.ts","excerpt":"const secretKey = runtime.getSetting(\"NEAR_WALLET_SECRET_KEY\");"},{"line":68,"path":"packages/plugin-near/src/actions/transfer.ts","excerpt":"const secretKey = runtime.getSetting(\"NEAR_WALLET_SECRET_KEY\");"}],"severity":"info"}],"headline":"No red flags found. README claims backed by the code: 1 of 8.","provenance":[{"id":"prov.stale","title":"No changes in 22 months","detail":"Unmaintained agents break as APIs and models change.","evidence":[{"path":"anoncf/aikol"}],"severity":"info"}],"generatedAt":"2026-10-15T10:53:42.174Z"}}