CC tron-wallet

This skill should be used when the user asks to 'check my TRX balance', 'show my TRON holdings', 'what tokens do I have on TRON', 'check my TRON wallet', 'TronLink balance', 'view my TRC-20 tokens', 'TRON transaction history', 'account info on TRON', or mentions checking wallet balance, viewing transaction history, or managing a TronLink wallet. Do NOT use for swap/trading — use tron-swap instead. Do NOT use for staking — use tron-staking instead.

ClawHub Agent Skills author: trondev v1.0.1 MIT-0 20 files · 3 scripts body ≈ 826 tokens Open the sourceclawhub.ai↗ analyzed 3 d ago

As a process C 58/100 · Has gaps — weak spots: result and completion, inputs and preconditions, consistency

Procedure Infrastructuretype and topics are labelled automatically from the skill text

Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode

JSON

Technical rating

68/100

safety, quality, tests

Safety 60%: 58
Quality 40%: 82
Run on models: none yet

Process rating

58/100

Has gaps

Result and completion w 14: 0
Inputs and preconditions w 11: 0
Consistency w 8: 40

the three weakest of ten parameters · all ten

What is at stake

Medium-severity findings: the skill is probably honest, but read what alarmed the scanner.

Dangerous commands medium severity

Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.

If you install

The skill contains commands that delete files, rewrite disks or execute code fetched from the network. The agent may run them without asking if it believes the instructions require it.

For the author

Replace destructive commands with safe equivalents that ask for confirmation, scope them to one folder, and stop piping curl into a shell: pin a version and a checksum.

How to improve

For the model run — optional

Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 30

✓ No critical or high findings

Medium and low: 30

medium Dangerous commands cmd-pipe-to-shell-known-host README.md:16

Pipe-to-shell installer from a well-known host (still executes remote code)
```
curl -sSL https://raw.githubusercontent.com/TronLink/tronlink-skills/main/install.sh | sh
```
medium Dangerous commands cmd-pipe-to-shell-known-host README.md:28

Pipe-to-shell installer from a well-known host (still executes remote code)
```
curl -sSL https://raw.githubusercontent.com/TronLink/tronlink-skills/main/uninstall.sh | sh
```
medium Dangerous commands cmd-shell-rc uninstall.sh:160

Writes to a shell startup file
```
echo "    ~/.bashrc  ~/.zshrc  ~/.profile"
```
low Secrets in code secret-high-entropy-token docs/claude-integration-guide.md:36

High-entropy token-like string (may be an id, hash or a credential)
```
💬 You: Check the TRX balance for T9yD…Wwb
```
low Secrets in code secret-high-entropy-token docs/claude-integration-guide.md:39

High-entropy token-like string (may be an id, hash or a credential)
```
[Executing: node scripts/tron_api.mjs wallet-balance --address T9yD…Wwb]
```
low Secrets in code secret-high-entropy-token docs/claude-integration-guide.md:46

High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)
```
[Executing: node scripts/tron_api.mjs resource-info --address T9yD…Wwb]
```
detector
low Secrets in code secret-high-entropy-token docs/claude-integration-guide.md:147

High-entropy token-like string (may be an id, hash or a credential)
```
Use tron_api.mjs to run a security audit on the USDT contract TR7N…j6t
```
low Secrets in code secret-high-entropy-token docs/claude-integration-guide.md:183

High-entropy token-like string (may be an id, hash or a credential)
```
node scripts/tron_api.mjs validate-address --address TR7N…j6t
```
low Secrets in code secret-high-entropy-token docs/integration-guide.sh:23

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
# 💬 "Check the TRX balance for this address: T9yD…Wwb"
```
quoted
low Dangerous commands cmd-pipe-to-shell-known-host install.sh:8

Pipe-to-shell installer from a well-known host (still executes remote code) (code comment)
```
#   curl -sSL https://raw.githubusercontent.com/TronLink/tronlink-skills/main/install.sh | sh
```
comment
low Secrets in code secret-high-entropy-token install.sh:315

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
echo "      --address TR7N…j6t"
```
quoted
low Secrets in code secret-high-entropy-token package-lock.json:130

High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)
```
"integrity": "sha5…9dM/mwVgvbZJaSNaRk+bshk…Kbz+IoId…W0Q==",
```
detector
low Secrets in code secret-high-entropy-token package-lock.json:173

High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)
```
"integrity": "sha5…SDq+2kAA…MOe/+5cdoEdg==",
```
detector
low Secrets in code secret-high-entropy-token package-lock.json:211

High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)
```
"integrity": "sha5…FrF+LTRo…W3g==",
```
detector
low Secrets in code secret-high-entropy-token package-lock.json:221

High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)
```
"integrity": "sha5…A6j+hAmM…GbS+kf5c…csw==",
```
detector
low Secrets in code secret-high-entropy-token package-lock.json:231

High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)
```
"integrity": "sha5…5bm+c2gQ…aG5+esrLODihIorn+Pe6F…dXA==",
```
detector
low Secrets in code secret-high-entropy-token package.json:24

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
"test": "node scripts/tron_api.mjs validate-address --address TR7N…j6t",
```
quoted
low Secrets in code secret-high-entropy-token README.md:81

High-entropy token-like string (may be an id, hash or a credential)
```
node scripts/tron_api.mjs token-info --contract TR7N…j6t
```
low Secrets in code secret-high-entropy-token README.md:86

High-entropy token-like string (may be an id, hash or a credential)
```
--to-token TR7N…j6t \
```
low Secrets in code secret-high-entropy-token scripts/tron_api.mjs:48

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
USDT: { contract: "TR7N…j6t", symbol: "USDT", decimals: 6,  name: "Tether USD" },
```
quoted
low Secrets in code secret-high-entropy-token scripts/tron_api.mjs:49

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
USDC: { contract: "TEkx…dz8", symbol: "USDC", decimals: 6,  name: "USD Coin" },
```
quoted
low Secrets in code secret-high-entropy-token scripts/tron_api.mjs:50

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
WTRX: { contract: "TNUC…WFR", symbol: "WTRX", decimals: 6,  name: "Wrapped TRX" },
```
quoted
low Secrets in code secret-high-entropy-token scripts/tron_api.mjs:51

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
BTT:  { contract: "TAFj…Vp4", symbol: "BTT",  decimals: 18, name: "BitTorrent" },
```
quoted
low Secrets in code secret-high-entropy-token scripts/tron_api.mjs:52

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
JST:  { contract: "TCFL…Zy9", symbol: "JST",  decimals: 18, name: "JUST" },
```
quoted
low Secrets in code secret-high-entropy-token SKILL.md:51

High-entropy token-like string (may be an id, hash or a credential) (documentation table row)
```
| USDT | `TR7N…j6t` |
```
table
low Secrets in code secret-high-entropy-token SKILL.md:52

High-entropy token-like string (may be an id, hash or a credential) (documentation table row)
```
| USDC | `TEkx…dz8` |
```
table
low Secrets in code secret-high-entropy-token SKILL.md:53

High-entropy token-like string (may be an id, hash or a credential) (documentation table row)
```
| WTRX | `TNUC…WFR` |
```
table
low Secrets in code secret-high-entropy-token SKILL.md:54

High-entropy token-like string (may be an id, hash or a credential) (documentation table row)
```
| BTT | `TAFj…Vp4` |
```
table
low Secrets in code secret-high-entropy-token SKILL.md:55

High-entropy token-like string (may be an id, hash or a credential) (documentation table row)
```
| JST | `TCFL…Zy9` |
```
table
low Dangerous commands cmd-pipe-to-shell-known-host uninstall.sh:15

Pipe-to-shell installer from a well-known host (still executes remote code) (code comment)
```
#   curl -sSL https://raw.githubusercontent.com/TronLink/tronlink-skills/main/uninstall.sh | sh
```
comment

Files scanned: 14. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

✓ No remarks against the Agent Skills spec

Process rating: all ten parameters 58/100

0Result and completion. Does not say what the result is
0Inputs and preconditions. Does not say what the process needs to start
40Consistency. Frontmatter name (tron-wallet) differs from the folder (tronlink-skills)
50Failures and branches. 0 branches, has a failure section
60Tools and files. Uses tools (bash, node) that frontmatter does not declare
100Steps. 11 steps
100When it triggers. States when to use and when not to
100Execution cost. Instruction body is 826 tokens
100Running it twice. No mutating operations
100Progress reporting. Reports progress

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

+5Description has no quoted example phrases that should trigger the skill
+3Output format is not stated: the model decides each time
-43 reference files, but SKILL.md never points to them: the model will not open them
-31 of 2 scripts are never mentioned in SKILL.md
+2Single-language instructions
+4Description says when NOT to use the skill
+3Description length 451: enough signal without eating the budget
+4Structure: 13 headings
+3Step-by-step instructions: 11 items
+4Has examples (8 code blocks)
+1License stated

Quality base 70; lint remarks subtract, signals add up to 100. Result: 82.

External checks

ClawHub: suspicious

This appears to be a read-only TRON query suite, but it needs review because a wallet-labeled skill installs and exposes a much broader persistent toolset than the top-level skill scope suggests.

LLM: suspicious (high) · VirusTotal: · 29 May 2026

Tests

— no evals.json

— no spec.yaml

— not run on models

Files · 20

docs/claude-integration-guide.md 7K
docs/integration-guide.sh 3K
docs/resource-model.md 3K
docs/staking-guide.md 4K
install.sh 12K
package-lock.json 21K
package.json 1K
README.md 6K
scripts/mcp_server.mjs 15K
scripts/tron_api.mjs 46K
skill-card.md 3K
SKILL.md 4K
uninstall.sh 7K
_meta.json 0K

Frontmatter

license: MIT

metadata: {"author":"tronlink-skills","version":"1.0.0","homepage":"https://trongrid.io"}

Dates

In catalog since 18 Mar 2026

Updated in catalog 11 May 2026

First seen here 10 Sept 2026

Last analysis 11 Sept 2026, 02:30 UTC

Last seen in crawl 9 h ago

Score history

Date		Score	Safety	Qual.
11 Sept 2026	C	68	58	82
10 Sept 2026	C	66	58	79