Decode raw EVM calldata into a named function, signature and arguments, plus security risk flags (unlimited token approval, setApprovalForAll, ownership transfer, unknown selector, native value transfer). Keyless, deterministic, no simulation - the cheap way for an agent to understand and risk-screen a piece of calldata before signing.