Emily - Your Radix Assistant

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a legitimate Radix blockchain lookup skill, with the main things to notice being that it installs a CLI and sends queries to a remote MCP service.

Before installing, be aware that this skill uses an npm-installed CLI to connect to a third-party Emily MCP endpoint. It does not request API keys or credentials, but wallet and token address lookups can still be sensitive if they are tied to your identity.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill may install and use a local command-line tool from npm.

Why it was flagged

The skill depends on installing an external npm CLI package. This is expected for its MCP setup, but it introduces a normal supply-chain trust decision.

Skill content

"requires": { "bins": ["mcporter"] }, "install": [{ "kind": "node", "package": "mcporter" }]

Recommendation

Install only if you trust the mcporter package source and your normal npm installation process.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

The remote service may see which wallet addresses, token addresses, domains, or Radix topics you ask about.

Why it was flagged

The skill registers a remote MCP endpoint, so Radix queries and parameters such as wallet or token addresses are sent to that external service.

Skill content

mcporter config add emily-radix-assistant https://www.ineedemily.com/api/mcp/mcp

Recommendation

Avoid querying addresses you consider private or identity-linked unless you are comfortable sharing that interest with the service provider.

Info

#ASI10: Rogue Agents

What this means

The Emily MCP server may remain configured for future invocations until removed from mcporter.

Why it was flagged

The setup creates a persistent local registration for the remote MCP server. The behavior is disclosed and aligned with the skill's purpose, with no evidence of hidden autonomous operation.

Skill content

If not found, register it ... mcporter config add emily-radix-assistant https://www.ineedemily.com/api/mcp/mcp

Recommendation

If you stop using the skill, remove the mcporter registration according to mcporter's configuration commands.