aurey-wallet-mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited aurey-wallet-mcp (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Load both skills from this repo into your agent host:
| Skill | Path | When |
|---|---|---|
| Onboarding | skills/aurey-wallet-onboarding/SKILL.md | First-time 1Claw + MCP (guide user; Hermes: aurey-setup in terminal) |
| Operations | skills/aurey-wallet/SKILL.md | Balances, swaps, sends after MCP is live |
User terminal (not chat):
cd /path/to/aurey-wallet-mcp
uv sync --group dev
uv run aurey-setup --host hermes # or cursor | claude | openclawDetails: install/hermes.md · cursor · claude · openclaw.
| Doc | Purpose |
|---|---|
| install/hermes.md | Hermes MCP + aurey-setup + using Aurey |
| docs/1claw-onboarding-guide.md | All hosts, manual 1Claw, agent instructions |
| docs/setup.md | Env reference, route builder, dashboard |
| ONBOARDING_1CLAW.md | One-page agent playbook |
| install/cursor.md / install/claude.md / install/openclaw.md | Same aurey-setup, different --host |
Cursor: skills/README.md for symlinks.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.