TronScan Account Profiler

• Analyzed: May 11, 2026, 6:12 AM
• Findings: 0
• Version: 1.0.5
• Hash: da54a13ef5c02c2023b392e5aa74ccf311b3237b193c2de1d735111004fe8f43
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: tronscan-account-profiler Version: 1.0.5 The skill bundle is a legitimate integration for profiling TRON blockchain accounts via the TronScan MCP server (mcp.tronscan.org). It provides read-only tools for querying balances, token holdings, and transaction history without any evidence of data exfiltration, malicious execution, or prompt injection.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI07: Insecure Inter-Agent Communication

Note

What this means

Wallet addresses the user asks about may be sent to TronScan's MCP service for lookup and analysis.

Why it was flagged

The skill is designed to call an external MCP server for wallet-profile data. This is purpose-aligned, but it creates an external data flow for the TRON addresses being queried.

Skill content

mcp-server: https://mcp.tronscan.org/mcp

Recommendation

Use the skill only for addresses you are comfortable querying through TronScan, and verify the MCP endpoint if provenance is important.