The on-chain detective Skill. The user inputs an on-chain address; the system first calls the address info Tool to get the profile, then based on user intent depth (simple query vs. fund tracing) decides whether to additionally call transaction history and fund flow tracing Tools.

• address

  : On-chain address (auto-detect format)

• chain

  (optional): Chain type (ETH/BSC/TRX/BTC, etc. — can be auto-inferred from address format)

• intent_depth

  : User intent depth

  • basic

    — just asking "who is this" / "how much do they hold"

  • deep

    — requesting "track funds" / "show transactions" / "where did the money go"

0x

bc1

1

3

T

get_address_info response
    │
    ├── User only wants a simple query (intent_depth = basic)
    │   └── → Output address profile report directly (skip to Step 5)
    │
    └── User requests deep tracking (intent_depth = deep)
        └── → Proceed to Step 4 parallel calls

• Address has known labels (e.g., exchange, hacker, whale) → likely worth investigating
• Address balance > $1M
• Address has risk flags

info_onchain_get_address_transactions

address={address}, chain={chain}, min_value_usd=10000, limit=20

info_onchain_trace_fund_flow

start_address={address}, chain={chain}, depth=3, min_value_usd=100000

Both Tools called in parallel.

min_value_usd

thresholds are adaptively adjusted based on address size.

info_onchain_get_address_transactions

info_onchain_trace_fund_flow

Address:

{address}

Chain: {chain} Query time: {timestamp}

Filter: Amount > ${min_value_usd} | Most recent {count} transactions

{counterparty}

• Frequent interactions with an exchange → likely depositing/withdrawing
• Large one-way outflows → possibly liquidating
• Interacting with many new addresses → possibly dispersing funds
• Regular fixed-amount transfers → possibly payroll/OTC

Trace depth: {depth} levels | Minimum amount: ${min_value_usd}

{address} (origin)
  ├── ${amount} → {addr_1} ({label_1})
  │     ├── ${amount} → {addr_1a} ({label})
  │     └── ${amount} → {addr_1b} ({label})
  ├── ${amount} → {addr_2} ({label_2})
  │     └── ${amount} → {addr_2a} ({label})
  └── ${amount} → {addr_3} ({label_3})

• Ultimate destination of funds (exchange? mixer? DeFi protocol?)
• Any suspicious patterns (split transfers, circular transfers, obfuscation paths)
• Associated known entities

• ⚠️ This address is flagged as: {risk_label}
• ⚠️ Associated addresses involved in: {risk_detail}

---

1. Privacy protection: Do not link on-chain addresses to specific natural persons (unless publicly labeled as institutional addresses)
2. Clear risk warnings: High-risk addresses must have prominent, unmistakable risk labels with reasons
3. No definitive characterization: Do not use terms like "criminal address" or "dirty money" — use objective language like "flagged as high risk" or "associated with suspicious activity"
4. Data source transparency: Label data sources (BlockInfo / Nansen / Arkham) must be attributed
5. Flag missing data: Fund tracing rolls out in phases; when unavailable, explicitly state it
6. Do not encourage stalking: If a user attempts to track many personal addresses for harassment purposes, prompt responsible use