TronScan Contract Analysis

Analyze TRON contracts: deploy info, hot methods, top callers, open-source status, transaction count. Use when user asks "contract verification", "contract s...

Security Scan

The skill is an instruction-only TronScan contract analysis helper that consistently calls TronScan MCP APIs and does not request unrelated credentials or install software.

Purpose & Capability

The name, description, and SKILL.md all consistently describe querying TronScan MCP APIs (getContractDetail, getContractCallStatistic, etc.). Required resources and actions align with the stated purpose. One transparency concern: the skill has no source repository or homepage listed and the registry owner is an opaque ID, so you cannot easily verify who published it or whether the MCP endpoint is the official one.

Instruction Scope

Runtime instructions stay on-topic: they instruct the agent to call specific TronScan MCP APIs with contract addresses and optional time ranges. The skill does not instruct reading local files, environment variables, or unrelated system state. It will send contract addresses and query parameters to the listed MCP server (mcp.tronscan.org), which is expected for this functionality.

Install Mechanism

No install spec and no code files (instruction-only). This is low-risk because nothing is written to disk or downloaded during install.

Credentials

The skill declares no required environment variables or credentials. The SKILL.md correctly notes that an optional TronScan Developer API key may be needed to avoid rate limits and should be configured in the MCP settings—this is proportional to the API usage and not excessive.

Persistence & Privilege

always is false and the skill is user-invocable; model invocation is allowed (the platform default). The skill does not request persistent system-wide configuration changes or access to other skills' credentials.

Assessment

This skill appears coherent and limited to calling TronScan MCP APIs, but before installing: 1) verify that https://mcp.tronscan.org is the official/trusted MCP endpoint you want to use (the skill has no source/homepage for publisher verification); 2) avoid sending any private keys or secrets — only supply public contract addresses; 3) if you hit rate limits, obtain an API key from TronScan and add it to your MCP config rather than pasting credentials into chat; and 4) treat the skill like a thin API client: it will transmit contract addresses and query parameters to the listed MCP server, so only use it if you trust that endpoint.

Contract Analysis

Overview

Tool	Function	Use Case
getContractDetail	Contract info	Balance, verification, call count, method map
getContractCallStatistic	Call stats	Call count, top callers, top methods
getContractCallers	Caller list	Callers and call count for a given day
getContractEvents	Events	Transfer events and method calls
getContractList	Contract list	Search by name/address, sort, paginate
getContractEnergyStatistic	Energy usage	Total and daily energy consumption
getContractTriggerTransactions	Trigger txs	Contract-triggered transactions in time range
getContractAnalysis	Daily analysis	Balance, transfers, energy, bandwidth, calls, fee

Use Cases

1. Deploy & Basic Info: Use getContractDetail for balance, verification status, call count, method mapping.
2. Hot Methods: Use getContractCallStatistic for top called methods.
3. Top Callers: Use getContractCallStatistic or getContractCallers for top 5 or full caller list.
4. Open-source / Verification: Verification status is in getContractDetail.
5. Transaction Count: Use getContractDetail or getContractTriggerTransactions for call/tx volume.
6. Malicious Clues: Combine events (getContractEvents), energy (getContractEnergyStatistic), and call stats to spot unusual patterns.

MCP Server

• Prerequisite: TronScan MCP Guide

Tools

getContractDetail

• API: getContractDetail — Get contract details (balance, verification status, call count, method map)
• Use when: User asks for "contract info", "contract address", or "is contract verified".
• Input: Contract address.
• Response: Balance, verified flag, call count, method map.

getContractCallStatistic

• API: getContractCallStatistic — Get contract call stats (call count, top callers, top methods)
• Use when: User asks for "hot methods", "top callers", or "who calls this contract".
• Input: Contract address (and optional time range).
• Response: Call counts, top callers, top methods.

getContractCallers

• API: getContractCallers — Get all callers and call count for a given day
• Use when: User asks for "caller list" or "who called today".
• Input: Contract address, date.

getContractEvents

• API: getContractEvents — Get contract events (transfer events and method calls)
• Use when: User asks for "contract events" or "transfers from contract".
• Input: Contract address, pagination.

getContractList

• API: getContractList — Get contract list with search by name/address, sort, pagination
• Use when: User searches contracts by keyword or browses list.

getContractEnergyStatistic

• API: getContractEnergyStatistic — Get contract energy consumption (total and daily)
• Use when: User asks for "contract energy" or "gas usage".

getContractTriggerTransactions

• API: getContractTriggerTransactions — Get contract-triggered transactions in a time range
• Use when: User asks for "contract transactions" or "recent calls".

getContractAnalysis

• API: getContractAnalysis — Get contract daily analysis (balance, transfers, energy, bandwidth, calls, fee)
• Use when: User asks for "contract activity over time".

Troubleshooting

• MCP connection failed: If you see "Connection refused", verify TronScan MCP is connected in Settings > Extensions.
• API rate limit / 429: TronScan API has call count and frequency limits when no API key is used. If you encounter rate limiting or 429 errors, go to TronScan Developer API to apply for an API key, then add it to your MCP configuration and retry.

Invalid contract address

Ensure the address is a valid TRON contract (not an EOA address). Use TRC20/721/1155 contract address for token contracts.

Notes

• To assess malicious risk: check verification, top methods (unusual names), energy spike, and event patterns.
• Top 5 callers and top methods come from getContractCallStatistic.