Miraix Wallet Roast

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI07: Insecure Inter-Agent Communication

What this means

The external service will receive the wallet address being analyzed and may be able to associate it with the request.

Why it was flagged

The skill sends the wallet address to an external Miraix API. This is disclosed and purpose-aligned, but a wallet address can reveal financial activity when analyzed.

Skill content

curl -sS -X POST https://app.miraix.fun/api/wallet-audit ... -d '{"walletAddress":"<wallet-address>","language":"<zh|en>"}'

Recommendation

Only submit wallet addresses you are comfortable having analyzed by the Miraix endpoint; do not provide private keys or seed phrases.

Note

ASI02: Tool Misuse and Exploitation

What this means

A user might rely on a returned command for a financial action, such as a token swap, without fully checking the destination, amounts, or risk.

Why it was flagged

The skill may display API-supplied rebalance or swap commands verbatim. It does not direct automatic execution, but such commands could affect assets if a user copies and runs them.

Skill content

Keep any `actions[].command` text verbatim when the user may want to execute it later.

Recommendation

Review any returned command carefully and require explicit user confirmation before executing financial transactions outside the skill.