Radix Explorer

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a read-only Radix blockchain query skill, with the main things to notice being its npm CLI install, persistent remote MCP registration, and sending queried wallet/token addresses to that remote service.

This skill looks suitable for read-only Radix research. Before installing, be comfortable with adding the mcporter npm CLI, registering the remote Emily MCP endpoint, and sending any wallet or token addresses you ask about to that external service.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill may add a local CLI dependency that the agent uses to contact the Radix data service.

Why it was flagged

The skill depends on installing an npm-provided CLI to access its MCP tools. This is disclosed and central to the skill, but it is still a package-provenance dependency users should recognize.

Skill content

node | package: mcporter | creates binaries: mcporter

Recommendation

Install only if you are comfortable with the mcporter package dependency and keep normal package-management hygiene, such as using trusted registries and reviewing updates.

Note

ASI07: Insecure Inter-Agent Communication

What this means

The remote service can see the Radix addresses and questions you ask it to look up, which may reveal interest in particular wallets or assets.

Why it was flagged

The skill registers and calls a remote MCP endpoint. Wallet, token, transaction, and other Radix queries are therefore sent to that external service.

Skill content

mcporter config add emily-radix-assistant https://www.ineedemily.com/api/mcp/mcp

Recommendation

Avoid querying addresses or portfolios you consider private unless you are comfortable sharing those lookups with the remote service.

Note

ASI10: Rogue Agents

What this means

The Radix MCP service may remain available to the agent after first setup until the registration is removed.

Why it was flagged

The setup persists the remote MCP server registration in mcporter. This is disclosed and purpose-aligned, not hidden persistence.

Skill content

If not found, register it ... mcporter config add emily-radix-assistant https://www.ineedemily.com/api/mcp/mcp

Recommendation

If you stop using the skill, remove the mcporter server registration according to mcporter's configuration commands.