Fluora Balance
PassAudited by ClawScan on May 1, 2026.
Overview
Fluora Balance appears to be a read-only USDC balance checker, but it does read and print your local Fluora wallet address and contacts Base Mainnet RPC.
Install only if you are comfortable letting the skill read your Fluora wallet address and display its USDC balance. Expect a public Base RPC endpoint to receive the balance query for that address. The artifacts do not show private-key use, transfers, deletions, or hidden data exfiltration.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent/session output can reveal your Fluora wallet address and USDC balance, and the Base RPC provider can observe the balance query for that address.
The script reads a local Fluora wallet configuration file, extracts the wallet address, and prints it as part of the balance result. This is expected for the purpose, but it is account-related financial metadata.
const walletsPath = path.join(process.env.HOME, ".fluora", "wallets.json"); ... const mainnetWallet = walletsData.USDC_BASE_MAINNET?.address; ... console.log(`Wallet: ${result.wallet}`);Use this skill only if you intend to let the agent check and display that wallet balance; avoid sharing the output publicly.
Installing dependencies adds third-party npm packages to the local environment before the balance checker runs.
The skill relies on a local Node.js helper and npm dependency installation before use. This is disclosed and purpose-aligned, but users should notice that third-party package code is installed.
cd scripts/ npm install # First time only node check_balance.js
Run installation only from the provided scripts directory, prefer the included lockfile, and review package.json/package-lock.json if you have supply-chain concerns.