Security audit
Security checks for vulnerabilities and agentic risk
This skill is a markdown-only guide for querying public TronScan contract data, with some routing ambiguity but no hidden execution, persistence, or data-changing behavior.
Installers should understand that this skill may route broad TRON contract questions to TronScan MCP and may need clearer boundaries around holder/token requests. It appears appropriate for public contract-analysis lookups, but it should not be treated as a full smart-contract audit or proof that a token/project is safe.
The trigger guidance includes broad phrases such as "contract verification," "contract safety," and activation when a user merely provides a contract address. These cues are underspecified and can cause the skill to trigger for many loosely related requests, leading to overbroad tool invocation, wrong-skill routing, and potentially misleading security assessments based on incomplete context.
The skill manifest explicitly says not to use this skill for token supply/holders, yet the documented toolset includes getHolderTokenBasicInfo for token balance and holding duration. This inconsistency can cause the agent to route out-of-scope holder-analysis requests to this skill, weakening intended skill boundaries and increasing the chance of misuse or incorrect data handling.
The tool-level phrase "contract info" is overly generic and overlaps with many requests outside this skill's stated purpose, such as source-code auditing, ABI help, tokenomics, or wallet/account inquiries. In an agentic routing system, this ambiguity can select the wrong tool and produce incomplete or inapplicable answers.
No suspicious patterns detected.
