TronScan Data Lookup
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a comprehensive set of scripts for querying TRON blockchain information including accounts, tokens, transactions, and blocks. All operations are read-only HTTP GET requests.
- [EXTERNAL_DOWNLOADS]: The skill communicates with external APIs to fetch blockchain data. It defaults to the official TronScan API (
apilist.tronscanapi.com) or a vendor-managed proxy (ts.bankofai.io) if no API key is provided. Both destinations are appropriate for the skill's stated purpose. - [CREDENTIALS_UNSAFE]: The skill safely handles API keys by reading them from the
TRONSCAN_API_KEYenvironment variable. It does not hardcode secrets or encourage the storage of private keys or wallet mnemonics. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the blockchain (such as transaction memos or token names). However, the scripts only format this data as JSON and output it to the console. There are no downstream capabilities like file writing, command execution, or network POST requests that could be subverted by malicious blockchain content, rendering the attack surface benign.
Audit Metadata