Personally i think it would be easier to do opposite. Not what things to avoid, but how to confirm ICO as legimate. Because if 95% of ICO's are scams, its easier to just look for legimate one's in garbage bin of all others.
Its very very very risky business.