feat(tronscan): add security checks and validation

[zuojr]

Summary

• Add a read-only security.js command for TronScan account, token, URL, transaction, multi-signature permission, and token-approval security signals.
• Validate TRON Base58Check addresses, token identifiers, transaction hashes, and URLs locally before querying; strip URL query strings and fragments before transmission.
• Return a normalized assessment while preserving the complete upstream response, and report incomplete responses as unknown rather than a clean result.
• Document the new workflow, add offline and live tests, and bump tronscan-skill to 1.1.0.
• Require token identifiers for TRC10/TRC20 address-history queries and refresh their smoke tests to match the current TronScan API contract.

Motivation

The existing skill exposes general TronScan lookups but not the Security Service endpoints. Several security endpoints return default values or omit invalid inputs, so strict local validation is needed to avoid false clean results.

The transfer validation adjustment was found while running the repository's full live smoke suite. The current TronScan endpoints require both the account address and token identifier:

• https://docs.tronscan.org/en/api/wallet/transfer-trc20
• https://docs.tronscan.org/en/api/wallet/transfer-token10

Testing

Commands run from tronscan-skill/:

node --check scripts/security.js
node --check scripts/transfer.js
node --check scripts/test_all.js
node tests/security.test.js
node scripts/test_all.js

Results:

• Offline validation and assessment tests: 11/11 passed
• Live smoke tests across all configured TronScan endpoints: 30/30 passed
• Invalid TRON addresses, transaction hashes, credential-bearing URLs, and transfer calls without required token identifiers were rejected before an API request.
• YAML frontmatter, JSON resources, package/lockfile version consistency, changed-file scope, and git diff --check passed.

Security

• All new API operations are read-only GET requests.
• No wallet, signing, private key, or transaction-broadcast path is introduced.
• URL credentials are rejected; query strings and fragments are removed before transmission.
• no_known_flags is explicitly documented as not being proof that a target is safe.

Related issues

None.

Coordination

PR #70 also touches the tronscan-skill version fields. If it lands first, this branch will need a small rebase/version adjustment.

[roger-gan]

Thanks for the thorough implementation and test coverage. The repository branch and release workflow changed after this PR was opened, so this PR needs to be migrated before review can continue.

PR #70 has been superseded by #75.

Please update this work as follows:

1. Rebuild the branch from the latest develop and target develop instead of main.
2. Use a feature/* source branch, for example feature/tronscan-security-checks. The new policy does not allow ordinary feat/* -> main PRs.
3. Keep the security command, local validation, transfer parameter fix, documentation, and tests.
4. Preserve private: true in tronscan-skill/package.json if feat!: consolidate TRON skills and remove Twitter skills #75 lands first.
5. Defer the 1.1.0 release-version changes to a future release_vX.Y.Z branch. For this feature PR, keep the current versions in SKILL.md, package.json, and package-lock.json, and record the changes under Unreleased rather than a dated 1.1.0 entry.

Because GitHub closes an open PR when its head branch is renamed, opening a replacement PR from the compliant feature/* branch is the safest migration path. Please link the replacement here when ready.

[zuojr]

Thanks for the migration guidance. I rebuilt the contribution from the latest develop on the compliant feature/tronscan-security-checks branch and opened replacement PR #76.

The replacement keeps the security command, local validation, transfer parameter fix, documentation, and tests; keeps the Skill/package versions at 1.0.0; records the changes under Unreleased; and preserves the PR #75 coordination note.

Replacement: #76