metamask-openclaw-wallet-integration
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The installation section in
SKILL.mddirects users to clone source code from an unverified third-party repository (https://github.com/veryyoldman/metamask-openclaw-skill.git). This repository is not controlled by the skill author or any recognized trusted organization. - [REMOTE_CODE_EXECUTION]: The "Windows one-command install" instructions explicitly chain
git clonewithnpm installandnpm run build. Executing these commands on source code from an unverified source allows for the execution of arbitrary malicious scripts defined inpackage.jsonlifecycle hooks or build scripts. - [COMMAND_EXECUTION]: The skill promotes the use of CLI tools (e.g.,
node dist/cli/openclaw.js) to perform sensitive operations like sending transactions, which relies entirely on the integrity of the unverified external code. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: Untrusted data enters the skill via recipient addresses and transaction amounts in the
sendNativeandsignMessagemethods as shown inSKILL.md. - Boundary markers: The skill documentation lacks explicit boundary markers or instructions to treat data as non-executable when interpolating parameters into its wallet operations.
- Capability inventory: The skill possesses capabilities for moving funds (
sendNative) and signing data (signMessage), which are significant impact actions if subverted. - Sanitization: No input sanitization is present in the provided examples, though the skill's design requires final user confirmation through the MetaMask browser extension UI.
Audit Metadata