metamask-agent-wallet

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill references python3 scripts/x402_pay.py for handling 402 payment requirements, but the script file itself is not provided in the workspace, constituting an unverifiable local runtime dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill documents direct financial operations including token transfers (mm transfer), EVM transactions (mm wallet send-transaction), token swaps/bridges (mm swap execute), perpetual futures trading (mm perps open), prediction market orders (mm predict place), and HTTP/MCP x402 payments (x402_pay.py). These operations are protected by documented server-enforced access controls and mechanisms such as MFA approval, configurable wallet policies, and trading-mode guards enforced independently of the agent.