check-aox-info

PassAudited by ClawScan on May 1, 2026.

Overview

This skill is a simple AOX information lookup that fetches public bridge/token status from a fixed AOX API and shows no credential use or data-changing behavior.

Before installing, be aware that the skill runs a Node script and contacts https://api.aox.xyz/info to return AOX bridge and token status. It does not request credentials or modify accounts, but you should independently verify any data before using it for financial decisions.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

When invoked, the skill contacts api.aox.xyz to get current AOX bridge/token status.

Why it was flagged

The skill makes a fixed external API call to retrieve AOX information. This is purpose-aligned and the artifact does not show user data, credentials, broad API access, or mutations being sent.

Skill content

const ENDPOINTS = {
  AOX: 'https://api.aox.xyz/info'
}
...
const res = await fetch(url)

Recommendation

Use it if you are comfortable relying on that AOX endpoint for informational results; verify important bridge or fee details before making transactions.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may fail or behave differently if the expected Node runtime is not available.

Why it was flagged

The skill command requires a Node runtime, while the registry metadata lists no required binaries. This is an under-declared runtime dependency, not evidence of hidden behavior.

Skill content

command: node script/index.js

Recommendation

The publisher should declare Node as a required binary or runtime expectation; users should ensure the runtime is available before installing.