TronScan SR Governance

• Analyzed: May 11, 2026, 6:42 AM
• Findings: 0
• Version: 1.0.3
• Hash: 20fb4879e4f49e4580f0bad40087393838d8729de61ad1d65c620bb6b13cd946
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: tronscan-sr-governance Version: 1.0.3 The skill bundle is a legitimate integration for querying TRON blockchain governance data (Super Representatives, voting, and chain parameters) via a dedicated MCP server (mcp.tronscan.org). The SKILL.md file contains standard operational instructions for the AI agent without any evidence of malicious intent, data exfiltration, or prompt injection attacks.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI07: Insecure Inter-Agent Communication

Note

What this means

Queries such as account vote lookups may reveal to the MCP provider which addresses or governance topics the user is interested in.

Why it was flagged

The skill is designed to use a remote MCP server, so user queries and supplied TRON addresses may be sent to that external service.

Skill content

mcp-server: https://mcp.tronscan.org/mcp

Recommendation

Use only if you trust the TronScan MCP endpoint, and avoid entering addresses you do not want associated with your query activity.

ASI03: Identity and Privilege Abuse

Note

What this means

A TronScan API key may be used for the user's API quota or account-specific access depending on TronScan's key policy.

Why it was flagged

The API key is optional and purpose-aligned for rate-limit handling, but it is still a credential that would be stored in MCP configuration.

Skill content

apply for an API key, then add it to your MCP configuration and retry

Recommendation

Store any API key securely, use the minimum scope available, and remove or rotate it if no longer needed.