MetaMask Agent Wallet

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:10 AM UTC
• Version: 0.1.0

Overview

The skill is clearly about a separate automated crypto wallet, but it asks users to run unaudited setup/dependency commands and persist wallet browser state, so it should be reviewed carefully before use.

Install only in a dedicated, unprivileged environment with a new low-value wallet. Review the actual package.json, lockfile, setup script, source code, and MetaMask extension provenance before running npm install or npm run setup, and delete or rotate ~/.agent-wallet if you stop using it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned External Dependency Resolution and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-34
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code:

bash

cd metamask-agent-skill
npm install
npx playwright install chromium

Technical Analysis

The setup instructions invoke npm install and npx playwright without specifying an exact Playwright version, integrity information, or a verified lockfile. The audited artifact contains only SKILL.md; it does not include the referenced package.json or package lockfile.

When a suitable local Playwright executable is unavailable, npx may resolve and download a package from the configured npm registry before executing its command-line entry point. This makes the executed code dependent on mutable external package resolution and the user's npm configuration. The artifact therefore does not provide enough information to reproduce or audit the code that these instructions may execute.

This finding establishes an unsafe dependency-resolution pattern, but the reviewed file contains no evidence that the legitimate Playwright package itself is malicious.

Attack Path

1. A user follows the documented installation procedure.
2. npm install or npx resolves packages using the user's configured npm registry and current dependency metadata.
3. An attacker compromises the resolved package, registry account, registry mirror, DNS/network path, or dependency configuration.
4. The attacker-controlled package is downloaded during installation or npx resolution.
5. Package lifecycle scripts or the resolved command-line entry point execute with the privileges of the user running the setup commands.
6. The malicious code can access resources available to that user, including files, environment variables, browser data, and wallet-related files.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the ins ...[truncated 579 chars]

Remediation

View remediation

Remediation Suggestions

1. Include a reviewed package.json and lockfile in the distributed project.
2. Pin Playwright and every other direct dependency to an exact version rather than a floating range.
3. Replace general installation instructions with npm ci, which enforces dependency versions from the lockfile.
4. Invoke the locally installed binary, such as npm exec --offline playwright -- install chromium, and configure npm to reject an unexpected network fallback.
5. Use the official npm registry or a controlled internal registry and enforce registry configuration in deployment documentation.
6. Validate lockfile integrity and review package provenance, signatures, maintainers, lifecycle scripts, and transitive dependency changes before upgrades.
7. Verify the integrity and provenance of downloaded Playwright browser artifacts.
8. Run installation and wallet automation in a dedicated, unprivileged operating-system account or isolated container with minimal filesystem and credential access.
9. Add automated dependency scanning and lockfile-diff review to the release process.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The setup instructions invoke npx playwright without pinning an explicit version, which can fetch whatever version is currently resolved from the registry at execution time. In a security-sensitive wallet automation skill, this weakens supply-chain integrity and reproducibility, and could expose users to malicious or compromised upstream package versions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The skill explicitly creates and reuses a persistent Chrome profile at ~/.agent-wallet/chrome-profile, which stores wallet state, session artifacts, and likely sensitive extension data over time. Even though the profile is described as isolated, persistence increases the blast radius of local compromise, accidental reuse, token/session leakage, or unintended carryover of approvals and connected dapps across runs.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

npx playwright install chromium

text

### 2. Create Agent Wallet Profile

```bash
npm run setup

Static analysis

No suspicious patterns detected.