Agent skill · Audited from source
Token Pick
skill · aaronjmars/aeonMIT licenceAudited 14 Oct 2026 · source 0448e87653f9
Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 0448e87653f9 and found no filesystem, network or shell access and no hard-coded secrets. What it does: One token recommendation and one prediction market pick - scored, quantified, with a skip branch when signals are weak
Cite
Cite this page
ModelsAtlas. “Token Pick (aaronjmars/aeon)”. Retrieved 14 Oct 2026. https://modelsatlas.com/skills/aaronjmars/token-pick
Trust audit
Audit 0.4.1 · source read 14 Oct 2026
SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 0 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | NA | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 0 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (0)
No findings at any severity. We re-audit when the source changes.
Audit 0.4.1 · source sha 0448e87653f9 · 14 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisheraaronjmars GitHub organizationOwner of the repository this skill is read from
- Source folderaaronjmars/aeon/skills/token-pickThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdict0448e87653f9A new audit runs when the source changes
- Repository statusNot archivedPushed today
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: One token recommendation and one prediction market pick - scored, quantified, with a skip branch when signals are weak
---
name: token-pick
description: One token recommendation and one prediction market pick - scored, quantified, with a skip branch when signals are weak
metadata:
title: Token Pick
mode: read-only
category: crypto
var: ""
tags:
- crypto
requires:
- COINGECKO_API_KEY?
capabilities:
- external_api
- sends_notifications
---
<!-- autoresearch: variation B — sharper output via signal scoring, edge calculation, conviction tiers, and a skip-day branch -->
> **${var}** — Focus area or thesis (e.g. "AI tokens", "election markets", "contrarian bets"). If empty, scans broadly.
Read `memory/MEMORY.md` for context.
Read the last 7 days of `memory/logs/` and grep for prior `Token Pick` entries — extract the symbols and market questions already picked. **Hard dedup gate**: do not re-pick the same token or the same prediction market unless there is a materially new catalyst that you can name in one sentence.
## Goal
Produce ONE token call and ONE prediction-market call per day, each with a numeric signal/edge score and a conviction tier. If neither qualifies for at least MEDIUM conviction, send a short "no picks today" message rather than forcing a weak pick.
## Steps
### 1. Fetch token data
```bash
# Optional demo key rides ./secretcurl's {COINGECKO_API_KEY} placeholder (never a bare
# $SECRET on the line); without a key the same public endpoint works at a lower rate limit.
CG_HDR=(); [ -n "${COINGECKO_API_KEY:+x}" ] && CG_HDR=(-H "x-cg-demo-api-key: {COINGECKO_API_KEY}")
# Trending coins
./secretcurl -s "${CG_HDR[@]}" "https://api.coingecko.com/api/v3/search/trending"
# Top 250 by market cap with 24h and 7d changes
./secretcurl -s "${CG_HDR[@]}" "https://api.coingecko.com/api/v3/coins/markets?vs_currency=usd&order=market_cap_desc&per_page=250&page=1&sparkline=false&price_change_percentage=24h,7d"
# BTC + ETH 24h/7d for relative-strength benchmark (extract from the markets call above; no extra request needed)
# DEX-side cross-confirmation (no auth, optional but preferred)
curl -s "https://api.dexscreener.com/latest/dex/search?q=trending"
```
If any curl returns empty or errors, retry once with **WebFetch** for the same URL. Track per-source status (`cg=ok|fail`, `dex=ok|fail`) — surfaced in the output footer.
### 2. Fetch prediction markets
```bash
# Top events by 24h volume (events group multi-outcome questions)
curl -s "https://gamma-api.polymarket.com/events?active=true&closed=false&order=volume_24hr&ascending=false&limit=30"
# Newer markets gaining traction
curl -s "https://gamma-api.polymarket.com/markets?closed=false&order=startDate&ascending=false&limit=20"
```
WebFetch fallback on failure. Track `poly=ok|fail`.
### 3. Score every candidate token (0–10 scale)
For each token in the top 250 (and the trending list), compute a signal score:
| Signal | Points |
|---|---|
| 24h price change > 0 | +1 |
| 7d price change > 0 | +1 |
| Both 24h and 7d > +5% | +2 (in addition to above) |
| Appears on CoinGecko trending list | +2 |
| Volume/MarketCap ratio ≥ 0.10 | +2 |
| Volume/MarketCap ratio ≥ 0.20 (replaces above) | +3 |
| Outperforming BOTH BTC and ETH on the 7d | +2 |
| Confirmed on DexScreener trending/gainers (cross-source) | +1 |
| Matches `${var}` thesis when set | +1 |
Drop candidates with market cap < $20M (too pumpable) unless `${var}` explicitly targets micro-caps. Drop any token already picked in the last 7 days (per dedup gate) unless you can name a fresh catalyst.
Pick the highest-scoring token. Use **WebSearch** to surface the most likely catalyst and at least one named risk (regulatory, unlock, narrative-faded, exchange listing, etc.).
### 4. Score prediction markets — edge calculation
For the top ~10 markets by 24h volume that pass the dedup gate (and `${var}` filter when set), do this for each:
1. Read the question and current YES price (`price`/`outcomePrices`).
2. Use **WebSearch** to gather 1–3 recent data points relevant to the resolution.
3. Estimate a **fair YES probability** as a single number (your best calibrated guess, not a range). State the 1–3 inputs you used.
4. Compute `edge = |fair − current_price|` as percentage points.
5. Liquidity gate: require 24h volume ≥ $50k AND market not resolving in < 24h (no last-minute mean-reversion roulette).
Pick the market with the largest edge that clears the gate. If you cannot defend a fair-value estimate within ±10% (insufficient public info), discard and try the next market.
### 5. Conviction tiers
| Tier | Token criterion | Market criterion |
|---|---|---|
| HIGH | signal score ≥ 7 | edge ≥ 10pp |
| MEDIUM | signal score 4–6 | edge 5–10pp |
| SKIP | signal score < 4 | edge < 5pp |
**Skip-day branch**: if BOTH the chosen token and the chosen market land in SKIP, do not synthesize a pick. Send the skip message (step 6b) and log accordingly. This is a feature — forcing low-conviction picks degrades the signal of the whole feed.
### 6a. Notification — normal day (under 4000 chars)
Send via `./notify`:
```
*Daily Pick — ${today}*
*Token: SYMBOL* [HIGH | MEDIUM] signal X/10
Price: $X.XX (±X.X% 24h / ±X.X% 7d) | mcap $XB | vol $XM (vol/mcap X.XX)
Score breakdown: [trending+2, vol/mcap+3, RS vs BTC/ETH+2, narrative+1] = 8/10
Catalyst: [one sentence — what's driving this right now, named source/event]
Risk: [one sentence — concrete risk, not generic "could go down"]
Vs recent picks: [first time / repeat with new catalyst: ...]
*Market: "Question?"* [HIGH | MEDIUM] edge Xpp
Current: YES X¢ / NO Y¢ | 24h vol $Xm | resolves: DATE
Fair YES: ~Y% (inputs: [src1], [src2], [src3])
Thesis: [one sentence — why the market is wrong, action implied]
Risk: [one sentence — what could make your fair-value estimate wrong]
sources: cg=ok|fail, dex=ok|fail, poly=ok|fail
not financial advice — pattern-matching only
```
If only one of the two pick types qualifies, send just that one section (omit the other entirely — do not include a HIGH and a SKIP in the same message).
### 6b. Notification —Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 0448e87
git clone https://github.com/aaronjmars/aeon git -C aeon checkout 0448e87653f9
The author documents no install command, so this uses the repository directly. Our verdict covers commit 0448e87653f9 only.
Works in
The author has not said which agents this skill supports, and we have not tested it in any.
Audit history
Every audit, every source change
- ✓SAFE B 89 / 100
first audit · source
0448e87653f9
Similar skills
aden-hive/hive
Multi-Agent Harness for Production AI
aden-hive/hive
SOP for debugging browser automation failures on complex websites. Use when browser tools fail on specific sites like LinkedIn, Twitter/X, SPAs, or sites with Shadow DOM.
aden-hive/hive
Required reading whenever any chart_* tool is available. Teaches the one-tool embedding contract (call chart_render → live chart appears in chat AND a downloadable PNG lands in the queen session dir), the ECharts (data…
aden-hive/hive
Claim tasks, record step progress, and verify SOP gates in the colony SQLite queue. Applies when your spawn message includes a db_path field.
aden-hive/hive
Proactively extract critical values from tool results into working notes before automatic context pruning destroys them.
aden-hive/hive
Follow a structured recovery decision tree when tool calls fail instead of blindly retrying or giving up.
Questions about Token Pick
What does the Token Pick skill do?
Is Token Pick safe to install?
What can Token Pick access on my machine?
How current is this page?
Sources
- github.com/aaronjmars/aeon/tree/main/skills/token-pick — the audited source at commit 0448e87653f9 and every finding aboveObserved · 14 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the Token Pick skill do?
- Is Token Pick safe to install?
- What can Token Pick access on my machine?