Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed TronScan account-analysis helper with no local code execution, persistence, or hidden data handling, though users should treat wallet profiling as privacy-sensitive.
Install only if you are comfortable sending TRON addresses and related queries to the configured TronScan MCP service. Use it for addresses you are authorized or comfortable analyzing, and be cautious when interpreting related-account, risk-tag, approval, and activity-pattern outputs because public blockchain data can still be privacy-sensitive or misleading without context.
The skill encourages profiling arbitrary TRON addresses, including related accounts, approvals, and activity patterns, without any privacy, consent, or sensitivity warning. While the data is publicly accessible on-chain, packaging it into an easy profiling workflow lowers the barrier to surveillance, deanonymization, and misuse against individuals or organizations.
The manifest describes this skill as being for profiling a TRON wallet-type address and recent activity for a provided address. However, the documented tools getAccountList and getAccountsWithHoldingTrx support broad ecosystem-level queries like top accounts and holder-count trends that do not profile a specific address.
The manifest explicitly says that contract identification or related contract analysis questions should switch to tronscan-contract-analysis, and says not to use this skill for single token details. Yet getApprovalChangeRecords is documented as taking a contractAddress and retrieving historical approval changes for a contract, which is outside the stated wallet-address profiling scope.
No suspicious patterns detected.
