tron-x402-payment

• Analyzed: May 12, 2026, 3:32 AM
• Findings: 1
• Version: 1.0.0
• Hash: 96aa2379c360d45e897eea1a3c7a2bd9b8f594aa87e4de7884fd5c3b47b8be95
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is classified as suspicious due to its handling of sensitive financial credentials and the execution of high-risk blockchain transactions. The `src/x402_tron_invoke.ts` script accesses the `TRON_PRIVATE_KEY` from environment variables and local configuration files (`~/.mcporter/mcporter.json`, `x402-config.json`), which is a sensitive operation. Furthermore, the skill is designed to perform TRC20 token payments, including an 'infinite approval' if the allowance is insufficient, which grants ongoing spending permission for the specified token. While the `SKILL.md` documentation and the TypeScript code include explicit security rules and sanitization to prevent private key leakage, the inherent risks associated with managing private keys and performing irreversible financial transactions warrant a 'suspicious' classification.