aurey-wallet — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited aurey-wallet (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP tools provide EVM operations with 1Claw Intents custody. If MCP is not configured yet, switch to [skills/aurey-wallet-onboarding/SKILL.md](../aurey-wallet-onboarding/SKILL.md).
from_address.resolve_known_address before other 0x addresses.resolve_known_address(chain, ticker) or resolve_token_by_address for one token. Call list_supported_tokens only with `chain` (never global). Do not paste large token lists into chat—use counts and a few examples.swap_prepare, tx_prepare_*) → show summary → tx_execute(prepared_id=...) only after explicit user confirmation.prepared_id over copying calldata.x402_preview then x402_fetch; auto-pay only under auto_approve_max_usd. Above that, get explicit user assent and retry with confirm_payment=true and max_price_usd bound to the quote. Do not use x402 for swaps—use swap_prepare.query / tag) or `get_x402_service` — do not guess URLs.get_agent_wallet_addresses and `x402_payment_status` if balance may be low.x402_fetch once. Else explain quote → user assents → x402_fetch with confirm_payment=true and max_price_usd bound to the quote.x402_batch_channel_status; offer x402_batch_refund for unused escrow.| Task hint | Service id (examples) |
|---|---|
| People / company / web search | stableenrich, auor-io |
| X / Twitter data | twit-sh |
| Portfolio / NFT / DeFi reads | zapper |
| IPFS pin/retrieve | pinata-x402 |
| Risk / trading signals | blackswan, einstein-ai |
| Cards / off-ramp | laso-finance, asterpay |
get_agent_wallet_addresses → ethereum as from_addressevm_get_erc20_balance / portfolio reads as neededswap_prepare → note prepared_id and feestx_prepare_erc20_approval if indicatedtx_prepare_lifi with prepared_idtx_execute(prepared_id=...)lifi_get_statusHermes install writes ~/.hermes/.env:
AUREY_ONECLAW_VAULT_ID, AUREY_ONECLAW_AGENT_ID, AUREY_ONECLAW_VAULT_API_KEY (ocv_…)Defaults in package: oneclaw_intents, standalone mode. Alchemy: 1Claw path api-keys/alchemy (~/.aurey/config.toml), not MCP env on Hermes.
No manual wallet address unless AUREY_DEEP_AGENT_WALLET_ADDRESS.
Setup: install/hermes.md (aurey-setup) · docs/setup.md
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.