Subscan API Skill

• Verdict: Advisory
• Analyzed: Apr 14, 2026, 2:31 PM
• Findings: 0
• Version: 1.0.0
• Hash: f6d806ec9f16d0d4919b3c706048861ea782f599918fa2cb3d97ed271f27bd27
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: subscan-api Version: 1.0.0 The subscan-api skill bundle is a well-structured tool for querying blockchain data via the Subscan API. It manages API keys by storing them locally in the user's home directory (~/.config/subscan-api-skill/key) and includes logic in subscan_api.py to ensure keys are not fully exposed in logs or conversation. The execution flow in SKILL.md is aligned with the stated purpose, and the network requests are directed to legitimate subscan.io endpoints. No indicators of malicious intent, data exfiltration, or unauthorized execution were found.