feat(defi): token_security_scanner v0.1 (GoPlus read-only)

[Hendobox]

Summary

• Adds defi/token_security_scanner v0.1 — standalone read-only GoPlus Token Security skill (scan, supported_chains) with normalized risk_tier / signals JSON for pre-trade agent checks ([New Skill]: defi/token_security_scanner, read-only token contract safety report (v0.1) #365).
• Fixture-backed offline tests; catalog page (five providers); card UI fixture; .env.example / extras / agent_loops index updates.
• Deliberately not a Hermes3 port: no DexScreener/UI chrome, explicit "0"/"1" flag parsing, Skillware action/status envelope.

Test plan

• pytest skills/defi/token_security_scanner/test_skill.py
• pytest tests/test_card_ui_schema.py tests/test_registry_docs.py tests/test_skill_docs.py
• Optional live smoke: scan against a known Base/Ethereum token with/without GOPLUS_APP_KEY

Closes #365

[rosspeili]

Thanks @Hendobox! The core implementation is clean, deterministic, and all tests (flake8, black, bundle tests, packaging smoke, and live GoPlus simulations) pass.

Before we merge, please address these two doc alignment items:

1. Align ## Skill history with repository standards

In docs/skills/token_security_scanner.md, the history section currently uses a 3-column format (Version | Date | Notes). Please align it with the 5-column standard used across other skill pages:

<!-- skill-history:begin -->
## Skill history

Commits that touched this skill bundle or its catalog page ([`defi/token_security_scanner`](https://github.com/ARPAHLS/skillware/tree/main/skills/defi/token_security_scanner)).

| Commit | Description | Date | Version | Contributors |
| :--- | :--- | :--- | :--- | :--- |
| [`92663fd`](https://github.com/ARPAHLS/skillware/commit/92663fdfe) | feat(defi): add token_security_scanner (GoPlus read-only scan) (#368) | 19 Sep 2026 | `0.1.0` | [@Hendobox](https://github.com/Hendobox) |
<!-- skill-history:end -->

2. Add a Web3 Ops Chaining Example

Under docs/skills/token_security_scanner.md (e.g. in the Usage or Chaining section), please add a brief code snippet demonstrating host-side chaining into defi/evm_tx_handler or finance/wallet_screening. For example:

# Scan contract before quoting or previewing a trade in evm_tx_handler
report = scanner.execute({"action": "scan", "chain": "base", "contract": token_contract})

if report.get("risk_tier") in ("critical", "high"):
    print(f"Blocked high-risk token trade: {report.get('contract_errors')}")
else:
    # Proceed to quote/preview with defi/evm_tx_handler
    preview = evm_handler.execute({
        "action": "quote",
        "chain": "base",
        "token_in": "ETH",
        "token_out": token_contract,
        "amount_in": 0.05,
    })

3. Optional: Add outputs: schema to manifest.yaml

Consider adding an outputs: block to skills/defi/token_security_scanner/manifest.yaml declaring top-level keys (status, chain, contract, risk_tier, signals, token, sources, warnings, contract_errors) for downstream schema tools.

Once these updates are pushed, I'll merge as is! Really nice work as always <3

[Hendobox]

@rosspeili Addressed the merge nits:

1. Skill history — 5-column table with commit links
2. Host-side chaining — scan → fail-closed gate (critical/high/unknown/error) → evm_tx_handler preview snippet in the catalog
3. outputs: — top-level keys declared on the manifest

Ready for another look / merge when you are. <3