MetaMask Smart Accounts KIt

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:01 AM UTC
• Version: 1.0.0

Overview

This is a coherent developer documentation skill for MetaMask smart-account workflows, with real financial authority examples that are disclosed and purpose-aligned but require careful user confirmation.

Install only if you are intentionally building MetaMask smart-account or delegation flows. Treat the examples as capable of spending tokens, spending gas, granting recurring permissions, and signing authority; use testnets first, keep private keys out of source code and logs, show users clear permission details, and require explicit confirmation before signing, granting permissions, or broadcasting transactions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The advanced-permissions example requests recurring ERC-20 authority (erc20-token-periodic) and marks adjustment as allowed, effectively demonstrating delegated spending power without an adjacent safety notice. Because this is framed as a normal usage example in a wallet-integrated environment, an agent could surface or automate permission prompts that grant ongoing asset access beyond a one-time transaction.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/delegations.md (reported line 290)May include surrounding context.

md

**⚠️ IMPORTANT:** Without caveats, delegations have infinite authority. Always use caveat enforcers.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill prominently covers smart-account operations, delegations, token transfers, and permission grants, but it does not include a clear user-facing warning that these examples can authorize spending or move real assets on-chain. In a wallet/Web3 context, omission of such warnings increases the chance that an agent or user treats examples as low-risk boilerplate and triggers irreversible financial actions without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The delegation redemption examples perform ERC-20 transfers and on-chain redemption flows through both smart accounts and EOAs, but they do not explicitly warn that execution is live, potentially irreversible, and may consume funds or gas. In a blockchain execution context, this omission can cause users or downstream agents to run examples against production environments without understanding the financial consequences.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 312)May include surrounding context.

md

- `redeemer` - Limit redemption to specific addresses
- `id` - One-time delegation with ID
- `nonce` - Bulk revocation via nonce
- `deployed` - Auto-deploy contract
- `ownershipTransfer` - Ownership transfer only
- `nativeTokenPayment` - Require payment
- `nativeBalanceChange` - Validate native balance

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/delegations.md (reported line 589)May include surrounding context.

md

- `redeemer` - Limit redemption to specific addresses
- `id` - One-time delegation with ID
- `nonce` - Bulk revocation via nonce
- `deployed` - Auto-deploy contract
- `ownershipTransfer` - Ownership transfer only
- `nativeTokenPayment` - Require payment
- `nativeBalanceChange` - Validate native balance

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The integration examples encourage automated daily token swaps and recurring native-token spending using ERC-7715 permissions, but they do not prominently warn that these permissions enable ongoing spending without per-transaction approval until expiry or revocation. In a Web3 developer reference, this omission can lead implementers to build flows that normalize broad recurring authorization, increasing the risk of user fund drain if the dapp, backend scheduler, session account, or redemption logic is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation shows signDelegation() being used with a raw privateKey parameter but does not explicitly warn users not to hardcode, log, commit, or otherwise expose private keys. In a Web3 delegation context, misuse of signing credentials can directly enable unauthorized delegation signing and asset theft, especially because delegations may grant broad authority over smart accounts.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/smart-accounts.md (reported line 11)May include surrounding context.

md

### Core Concepts

| Concept                  | Description                                                                                            |
| ------------------------ | ------------------------------------------------------------------------------------------------------ |
| **User Operation**       | Package of instructions signed by user, specifying executions for the smart account                    |
| **Bundler**              | Service that collects user operations, packages them into a single transaction, and submits to network |

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · references/advanced-permissions.md (reported line 490)May include surrounding context.

Extending Clients

Wallet Client for Requesting Permissions:

typescript

import { erc7715ProviderActions } from '@metamask/smart-accounts-kit/actions'

Static analysis

No suspicious patterns detected.