← 返回 Skills 市场
1771
总下载
5
收藏
2
当前安装
1
版本数
在 OpenClaw 中安装
/install metamask-agent-wallet-skill
功能描述
Control a sandboxed MetaMask browser extension wallet for autonomous blockchain transactions. Features configurable permission guardrails including spend limits, chain allowlists, protocol restrictions, and approval thresholds. MetaMask-only (other wallets not supported).
安全使用建议
Do not install or run this skill as-is. The SKILL.md requires installing npm packages and Playwright and creating a browser profile and wallet, but the published package contains no source code or install manifest — that mismatch is suspicious. Before proceeding, ask the publisher for: (1) the complete source code or a published release (GitHub/Git tag) you can inspect; (2) a package.json with pinned dependency versions or a vendor-verified bundle; (3) clear instructions for where private keys/seeds are stored and how approvals are delivered to you; (4) an explicit install manifest or cryptographically-signed release (not just 'npm install' from an unspecified registry). If you must test, run it in a fully isolated VM, use a throwaway funded wallet only, inspect permissions.json and blockedMethods, and verify network activity and files created under ~/.agent-wallet. If the publisher cannot provide source or a verifiable release, consider this skill too risky.
功能分析
Type: OpenClaw Skill
Name: metamask-agent-wallet-skill
Version: 0.1.0
The OpenClaw AgentSkills skill bundle for 'MetaMask Agent Wallet' appears benign. The `SKILL.md` clearly outlines the purpose of controlling a sandboxed MetaMask wallet with extensive security guardrails, including isolated browser profiles, separate wallets, configurable spend limits, protocol allowlists, and an explicit approval flow for high-value transactions. There is no evidence of prompt injection attempts against the agent, data exfiltration, malicious execution, persistence mechanisms, or obfuscation. The setup instructions involve standard `npm install` and `npx playwright install chromium` commands, which are typical for a Node.js project interacting with a browser, and do not inherently indicate malicious intent.
能力评估
Purpose & Capability
The declared metadata lists no required binaries, env vars, or config paths, but SKILL.md instructs the user/agent to run npm install, npx playwright install, npm run setup, install a MetaMask extension, and create files under ~/.agent-wallet. A MetaMask automation skill would legitimately need browser automation and dependencies, but the package provides no code or install manifest and does not declare the filesystem paths it will use — an internal inconsistency.
Instruction Scope
Runtime instructions direct the creation of a Chrome profile, installation of MetaMask, storing wallet seed in the extension/profile, writing logs to ~/.agent-wallet/logs, and reading/writing permissions.json. They also allow signing arbitrary messages and performing transactions. The instructions do not specify how secret material (seed/private keys) is protected, how approval prompts reach the user, or how the agent obtains the code it runs — granting broad, unclear privileges to network and filesystem access.
Install Mechanism
There is no install spec in the skill metadata, but SKILL.md tells users to run npm install and npx playwright install, which will fetch and execute code from remote package registries. Without a package.json, source repository, or pinned release URL, this is high risk: npm installs pull arbitrary third-party code and Playwright will download browser binaries. The absence of a verified install mechanism is a red flag.
Credentials
The skill declares no required credentials, which superficially reduces risk, but the instructions require creating and funding a wallet and implicitly rely on local private keys managed by MetaMask in the created profile. The skill does not document where secrets are stored, how approvals are authenticated, or what code can access the profile directory. Requesting no env vars while instructing creation of sensitive local secrets is disproportionate and underspecified.
Persistence & Privilege
always:false and user-invocable are appropriate. However, the instructions create persistent artifacts (Chrome profile, extension, permissions.json, logs under ~/.agent-wallet) and will likely run background automation (Playwright controlling a browser). The skill does not request platform-level always-on privileges, but it will leave persistent on-disk state and potentially long-running processes if installed/run.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install metamask-agent-wallet-skill - 安装完成后，直接呼叫该 Skill 的名称或使用
/metamask-agent-wallet-skill触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v0.1.0
- Initial release of MetaMask Agent Wallet Skill.
- Enables autonomous control of a sandboxed MetaMask browser wallet, with robust permission guardrails.
- Supports spend limits, chain and protocol allowlists, and approval thresholds via `permissions.json`.
- Provides command-line actions for connecting to dapps, swapping tokens, sending tokens, signing messages, checking balances, and viewing transaction history.
- Implements isolated browser and wallet profiles for enhanced security; all actions and outcomes are logged.
- Architecture designed for future integration with Gator on-chain permissions.
元数据
常见问题
MetaMask Agent Wallet 是什么？
Control a sandboxed MetaMask browser extension wallet for autonomous blockchain transactions. Features configurable permission guardrails including spend limits, chain allowlists, protocol restrictions, and approval thresholds. MetaMask-only (other wallets not supported). 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 1771 次。
如何安装 MetaMask Agent Wallet？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install metamask-agent-wallet-skill」即可一键安装，无需额外配置。
MetaMask Agent Wallet 是免费的吗？
是的，MetaMask Agent Wallet 完全免费（开源免费），可自由下载、安装和使用。
MetaMask Agent Wallet 支持哪些平台？
MetaMask Agent Wallet 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 MetaMask Agent Wallet？
由 Francesco（@andreolf）开发并维护，当前版本 v0.1.0。
推荐 Skills