TronScan SR Governance

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Queries such as account vote lookups may reveal to the MCP provider which addresses or governance topics the user is interested in.

Why it was flagged

The skill is designed to use a remote MCP server, so user queries and supplied TRON addresses may be sent to that external service.

Skill content

mcp-server: https://mcp.tronscan.org/mcp

Recommendation

Use only if you trust the TronScan MCP endpoint, and avoid entering addresses you do not want associated with your query activity.

Note

ASI03: Identity and Privilege Abuse

What this means

A TronScan API key may be used for the user's API quota or account-specific access depending on TronScan's key policy.

Why it was flagged

The API key is optional and purpose-aligned for rate-limit handling, but it is still a credential that would be stored in MCP configuration.

Skill content

apply for an API key, then add it to your MCP configuration and retry

Recommendation

Store any API key securely, use the minimum scope available, and remove or rotate it if no longer needed.