check-aox-info

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

When invoked, the skill contacts api.aox.xyz to get current AOX bridge/token status.

Why it was flagged

The skill makes a fixed external API call to retrieve AOX information. This is purpose-aligned and the artifact does not show user data, credentials, broad API access, or mutations being sent.

Skill content

const ENDPOINTS = {
  AOX: 'https://api.aox.xyz/info'
}
...
const res = await fetch(url)

Recommendation

Use it if you are comfortable relying on that AOX endpoint for informational results; verify important bridge or fee details before making transactions.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may fail or behave differently if the expected Node runtime is not available.

Why it was flagged

The skill command requires a Node runtime, while the registry metadata lists no required binaries. This is an under-declared runtime dependency, not evidence of hidden behavior.

Skill content

command: node script/index.js

Recommendation

The publisher should declare Node as a required binary or runtime expectation; users should ensure the runtime is available before installing.