← 返回 Skills 市场
216
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install tronlink-skills
功能描述
This skill should be used when the user asks to 'check my TRX balance', 'show my TRON holdings', 'what tokens do I have on TRON', 'check my TRON wallet', 'Tr...
安全使用建议
This package contains code and an installer despite being listed as 'instruction-only' — treat it as a code package, not just documentation. Before installing or running anything: 1) Inspect scripts/tron_api.mjs and the rest of scripts/ for any code that reads files, asks for or stores private keys, or posts data to unexpected endpoints. 2) Do NOT run the shown curl | sh installer without reviewing its contents; prefer to git clone the repo and read install.sh locally. 3) Verify repository origin (GitHub org and commit history) and confirm you trust it. 4) If you only need read-only queries, consider running individual scripts in a sandboxed environment (container or VM) and avoid registering the MCP server globally. 5) If asked to provide keys/secrets, refuse unless you reviewed the code that will use them; TRONGRID_API_KEY is reasonable for rate limits, but never provide private keys or seed phrases. If you want, I can scan scripts/tron_api.mjs and any remaining omitted files for specific risky operations (key handling, network exfiltration, unsafe shell execution) — give me permission to analyze those files further.
功能分析
Type: OpenClaw Skill
Name: tronlink-skills
Version: 1.0.1
The TronLink Skills bundle is a comprehensive and well-documented set of tools designed for AI agents to interact with the TRON blockchain. The core logic in `scripts/tron_api.mjs` is explicitly read-only, focusing on balance queries, token metadata, market data, and resource estimation without handling private keys or transaction signing. The installation script (`install.sh`) and MCP server (`scripts/mcp_server.mjs`) provide legitimate integration paths for platforms like Claude Code and Cursor. While the bundle uses an unusual domain for swap quotes (`endjgfsv.link`), the documentation correctly identifies it as a Sun.io CDN endpoint. No evidence of malicious intent, data exfiltration, or unauthorized execution was found.
能力评估
Purpose & Capability
The skill's name/description promise read-only TRON wallet queries. However the package contains an installer (install.sh), an MCP server (scripts/mcp_server.mjs) that registers global tools, and a large package-lock with crypto/web3 libs (tronweb, ethers, bip39, @noble/*, aes-js). Those dependencies are capable of key derivation/signing even though package.json declares no dependencies and README asserts 'read-only'. The mismatch between claimed scope and included components is disproportionate and unexplained.
Instruction Scope
SKILL.md commands themselves are limited to running node scripts/tron_api.mjs with address/contract parameters (balance, token list, tx history, validate address). That is coherent with the stated purpose. However other docs (integration guides) and mcp_server instruct the agent/environment to execute these scripts (including uploading/trusting tron_api.mjs in remote Claude conversations). The installer also copies/edits project-level files (CLAUDE.md, symlinks into project directories) which expands the runtime scope beyond simple read-only queries.
Install Mechanism
Registry metadata said 'instruction-only' but the repository includes install.sh and an explicit curl | sh installation example (raw.githubusercontent.com). The installer clones from GitHub (a known host) and auto-registers MCP servers and symlinks into user config directories. While GitHub is a standard host, piping a remote install script to sh is a risky pattern and the presence of an installer not declared in the registry is an incoherence to surface.
Credentials
The skill declares no required env vars in registry, but documentation references an optional TRONGRID_API_KEY and TRON_NETWORK. Those optional vars are appropriate for a TRON API client. However the repository includes cryptographic and wallet-related libraries (bip39, ethereum-cryptography, aes-js, tronweb/ethers in package-lock) that could be used to manage private keys; this contradicts the README's 'read-only' claim and merits inspection before granting any environment-level secrets or copying code into production.
Persistence & Privilege
The installer attempts to register a global MCP server (claude mcp add -s user tronlink) and create symlinks / copy files into user project/config directories (.cursor, ~/.agents/skills, ~/.config/opencode, etc.). Although always:false and autonomous invocation are normal, the install scripts modify other tools' configurations and register global tools — a higher privilege action that should be intentional and audited.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install tronlink-skills - 安装完成后，直接呼叫该 Skill 的名称或使用
/tronlink-skills触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.1
tronlink skills v1.0.1
- Added comprehensive documentation in SKILL.md covering command usage, common token contracts, troubleshooting, and skill routing.
- Clarified intended use cases and command-line instructions for wallet balance, TRC-20 holdings, transaction history, account info, and address validation.
- Provided guidance on prerequisites, address formats, and interactions with other related skills (swap, staking, market, resource).
- Included troubleshooting tips and details for handling common user issues (unactivated accounts, bandwidth, and energy requirements).
元数据
常见问题
tronlink-skills 是什么？
This skill should be used when the user asks to 'check my TRX balance', 'show my TRON holdings', 'what tokens do I have on TRON', 'check my TRON wallet', 'Tr... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 216 次。
如何安装 tronlink-skills？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install tronlink-skills」即可一键安装，无需额外配置。
tronlink-skills 是免费的吗？
是的，tronlink-skills 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
tronlink-skills 支持哪些平台？
tronlink-skills 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 tronlink-skills？
由 trondev（@bbsyaya）开发并维护，当前版本 v1.0.1。
推荐 Skills