sign-evm-message
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is primarily instructional, providing boilerplate code and documentation for implementing standard Ethereum signing methods (EIP-191 and EIP-712).
- [EXTERNAL_DOWNLOADS]: The skill demonstrates usage of the @metamask/connect-evm package. This is an official library provided by the skill's author ('metamask'), and its inclusion represents standard SDK integration rather than a security risk.
- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates how to sign data provided to the agent (such as sign-in messages). While this represents a surface where untrusted data could be processed, the demonstrated workflow is safe because all signature requests in MetaMask require explicit manual approval from the human user via the wallet interface before completion.
Audit Metadata