Security audit
Security checks across malware telemetry and agentic risk
This is a real EVM wallet helper, but it stores wallet secrets locally and can change the host environment in ways users should review carefully.
Treat this as a high-risk hot-wallet skill. Do not import a valuable existing seed phrase or private key; use a fresh wallet with limited funds, review the install scripts before running them, avoid granting sudo during setup, remove plaintext password/mnemonic files promptly, and require explicit human confirmation before any transaction is signed or broadcast.
4. **Onboarding flow** (automatic when no wallet exists). If the readiness check exits with 1, walk through the scripted steps in order, mirroring their prompts and explicitly asking the user for every required piece of information before running the next script. After the key-material step finishes, share the derived address immediately so the user sees it before we ask them for anything in step 3: 1. Installation — explain that the script will ensure Foundry/cast is installed so every mentioned `cast` command works before proceeding. 2. Key material — before running the wallet step, ask whether they want to create a new hot keypair, import a 12/24-word MetaMask-compatible mnemonic (`m/44'/60'/0'/0/0`), or import a private key. Collect the chosen secret, confirm the resulting address right after the step finishes, and tell the user that address before moving on. When generating a new keypair, capture the mnemonic displayed by `cast wallet new`, save it to `~/.agent-wallet/mnemonic-words-<timestamp>.txt`, and tell the user the exact path plus the fact that a job (via `at now + 1 hour` if available or a background `sleep` fallback) will delete that file after 60 minutes so the seed phrase does not linger. 3. Password — only ask for the keystore password once (there is no confirmation prompt, no save/remember question, and the account name is forced to “agent”). The script saves that password to the local helper file and uses it when creating the keystore, so nothing else is needed from the user for this step. 4. Network — read aloud the default network list derived from `assets/evm-networks.json`, ask which numbered network they want, and note that the script now auto-selects the first RPC URL from that entry (it saves the matching `CHAIN_ID`/`ETH_RPC_URL` and then just shows the RPC so the user can see which endpoint is being used). 5. Tokens — the script now prints the token table derived from `assets/evm-network-tokens.json` so it appears directly i ...[truncated 25 chars]
return 1
fi
if [[ -x "/usr/bin/sudo" ]]; then
if ! sudo sh -c "$installer > /tmp/at-install.log 2>&1"; then
warn "Failed to install 'at' with sudo; mnemonic cleanup will be manual."
return 1
fi## Scripts - **Step scripts** — `scripts/01_install_cast.sh`..`06_finish.sh` cover the onboarding flow described in the README: install Foundry/cast, create or import a key, encrypt the keystore, choose network/RPC/tokens (sourced from the JSON assets), and show the resulting address and balance. Run them in order when the user requests onboarding. Each script already prompts for the necessary inputs (mnemonic/private key, password, RPC URL, token details), so relaying the same questions to the user and then running the next script is the recommended approach. - **Wallet health check** — `scripts/check_wallet.sh` inspects the shared state and reports whether a keystore/address pair already exists; it returns success (0) when a wallet is present and 1 otherwise. - **Network status** — `scripts/show_network.sh` prints the active network name, chainId, and RPC URL from `~/.agent-wallet/state.env`, or warns if the configuration is incomplete. - **Wallet removal** — `scripts/remove_wallet.sh` safely deletes the keystore, password stash, and metadata from `~/.agent-wallet/state.env` after an explicit confirmation.
exit 0 fi if ! has_cmd curl; then err "curl is required but not found. Install curl and re-run." exit 1 fi warn "cast not found. Installing Foundry..."
exit 1
fi
warn "cast not found. Installing Foundry..."
curl -L https://foundry.paradigm.xyz | bash
enable_strict_path
if ! has_cmd foundryup; then
for p in "${HOME}/.bashrc" "${HOME}/.zshrc" "${HOME}/.profile"; do66/66 vendors flagged this skill as clean.
No suspicious patterns detected.