wallet
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill manages private keys by storing them in encrypted keystores located at
~/.monskills/keystore. It follows a secure pattern of on-the-fly decryption only when a signature is required, ensuring that raw private keys are never stored in plaintext. Transaction signatures are sent to the official Safe Transaction Service, a well-known industry standard, for multi-party execution. - [EXTERNAL_DOWNLOADS]: The skill includes a self-bootstrapping script (
propose.sh) that sets up a local dependency cache. It downloads well-known and standard blockchain libraries (viem,qrcode-terminal) from the official NPM registry to facilitate transaction signing and QR code generation. - [COMMAND_EXECUTION]: The instructions utilize the Foundry toolkit (
cast,forge) for local wallet generation, transaction simulation, and contract deployment. These tools are used within their intended scope for blockchain development and do not involve suspicious execution of arbitrary or obfuscated code. - [PROMPT_INJECTION]: The skill explicitly instructs the agent to never request a user's private key and mandates that all transactions must be proposed via a Safe multisig. These instructions serve as internal safety guardrails rather than attempts to bypass platform security.
Audit Metadata