MegaETH AI Developer

PassAudited by ClawScan on May 10, 2026.

Overview

This is a coherent instruction-only MegaETH developer guide, but it includes real wallet transaction and deployment workflows that users should explicitly approve before running.

This skill appears safe as a documentation/playbook skill, not an executable package. Before using it with an agent that can access wallets or developer tools, require confirmation for every transaction, token approval, bridge, swap, or deployment, and verify any external repositories or commands before running them.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If an agent or user runs broadcast commands with the wrong chain, contract, wallet, or gas settings, funds can be spent and on-chain actions may be irreversible.

Why it was flagged

The documentation includes a command that broadcasts an on-chain deployment while skipping local simulation. This is purpose-aligned for MegaETH development, but broadcasting blockchain transactions is high-impact and should not be run blindly.

Skill content
forge script Deploy.s.sol \
    --rpc-url https://mainnet.megaeth.com/rpc \
    --gas-limit 5000000 \
    --skip-simulation \
    --broadcast
Recommendation

Require explicit user approval before any transaction, swap, bridge, or deployment broadcast. Confirm chain ID, recipient/contract, amount, calldata, gas limit, and wallet before execution.

What this means

Connected wallets or local signing tools can spend funds, approve tokens, deploy contracts, or reveal account activity if misused.

Why it was flagged

The skill is intended to guide wallet and account operations. That is disclosed and purpose-aligned, but it involves delegated wallet authority if the agent has access to signing tools.

Skill content
Use this Skill when the user asks for:
- Wallet setup and management on MegaETH
- Sending transactions, checking balances, token operations
Recommendation

Keep private keys out of the agent context when possible, use hardware or wallet confirmation flows, and approve each fund-moving or approval-granting action manually.

What this means

Running external install or build commands can execute code from outside this skill’s reviewed content.

Why it was flagged

The skill documents downloading and building external MegaETH debugging tooling. This is expected for a developer guide, but it depends on external source code not included in the reviewed artifacts.

Skill content
git clone https://github.com/megaeth-labs/mega-evm
cd mega-evm/bin/mega-evme
cargo build --release
Recommendation

Verify repository URLs, review upstream code or releases, and prefer pinned versions or checksums before building or running external tools.