metamask-agent-wallet — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited metamask-agent-wallet (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill documents the mm CLI surface for MetaMask Agent Wallet authentication, wallet lifecycle, balance queries, token transfers, message and typed-data signing, raw transactions, chain discovery, market data, token discovery, perpetual futures trading, prediction market trading, token swaps, and cross-chain bridges.
Use the routing table to select the relevant reference file. CLI behavior lives in references/. Repeatable operational patterns live in workflows/.
Match the user's intent to a command and reference file, then read the reference before constructing a command. If intent spans multiple domains, load them sequentially in dependency order.
| User Intent | Command | Reference |
|---|---|---|
| Check authentication status | mm auth status | auth.md |
| Login in MetaMask Agentic CLI | mm login | auth.md |
| Choose a wallet mode and set up policies | mm init | auth.md |
| Show current init settings | mm init show | auth.md |
| Sign in via QR code with MetaMask Mobile | mm login qr | auth.md |
| Sign in via Google | mm login google | auth.md |
| Sign in via email OTP | mm login email | auth.md |
| Sign out | mm logout | auth.md |
| Reset CLI session | mm reset | auth.md |
| Show CLI configuration | mm config get | auth.md |
| Set CLI configuration | mm config set | auth.md |
| Set BYOK mnemonic encryption password | mm wallet password set | auth.md |
| Change BYOK mnemonic encryption password | mm wallet password change | auth.md |
| Remove BYOK mnemonic encryption password | mm wallet password remove | auth.md |
| Interpret raw CLI error codes | AuthError, ValidationError, WALLET_ERROR | errors.md |
| Decode EVM calldata into a human-readable intent | mm decode | decode.md |
| Create a wallet | mm wallet create | wallet.md |
| List all wallets | mm wallet list | wallet.md |
| Switch active wallet | mm wallet select | wallet.md |
| Show active wallet details | mm wallet show | wallet.md |
| Show active wallet address | mm wallet address | wallet.md |
| Check the active wallet balance | mm wallet balance | wallet.md |
| Show current trading mode and policies | mm wallet trading-mode get | wallet.md |
| Set trading mode (guard or beast) | mm wallet trading-mode set | wallet.md |
| Sign a plaintext message | mm wallet sign-message | signing.md |
| Sign EIP-712 typed data | mm wallet sign-typed-data | signing.md |
| Send a raw EVM transaction | mm wallet send-transaction | transaction.md |
| Transfer native tokens or ERC-20 tokens | mm transfer | transfer.md |
| List supported chains by the CLI | mm chains list | chain.md |
| List pending wallet requests | mm wallet requests list | polling.md |
| Watch a wallet polling id | mm wallet requests watch | polling.md |
| Query spot or historical prices | mm price ... | market-data.md |
| Discover tokens, token networks, or token metadata | mm token ... | market-data.md |
| List perpetual markets | mm perps markets | perps.md |
| Check perps account balance | mm perps balance | perps.md |
| List open perpetual positions | mm perps positions | perps.md |
| Get a quote for a perpetual order | mm perps quote | perps.md |
| List resting perpetual orders | mm perps orders | perps.md |
| Open a perpetual position | mm perps open | perps.md |
| Close a perpetual position | mm perps close | perps.md |
| Modify leverage, take-profit, or stop-loss | mm perps modify | perps.md |
| Cancel a resting perps order | mm perps cancel | perps.md |
| Deposit USDC into a perps venue | mm perps deposit | perps.md |
| Withdraw USDC from a perps venue | mm perps withdraw | perps.md |
| Transfer USDC between spot and perp accounts | mm perps transfer | perps.md |
| List perpetual futures venues | mm perps list-venues | perps.md |
| List available DEXs for a venue | mm perps dexs | perps.md |
| Set Predict trading mode | mm predict mode | predict.md |
| One-time Predict setup | mm predict setup | predict.md |
| Create or refresh Predict credentials | mm predict auth | predict.md |
| Repair Predict approvals | mm predict approve | predict.md |
| Check Predict back-end status and account setup | mm predict status | predict.md |
| Check if Polymarket is geoblocked for your IP | mm predict geoblock | predict.md |
| List prediction markets | mm predict markets list | predict.md |
| Search prediction markets | mm predict markets search | predict.md |
| Inspect a prediction market | mm predict markets get | predict.md |
| List Polymarket events | mm predict events list | predict.md |
| Inspect a Polymarket event | mm predict events get | predict.md |
| List Polymarket event series | mm predict series list | predict.md |
| Inspect a Polymarket event series | mm predict series get | predict.md |
| List Polymarket tags | mm predict tags list | predict.md |
| Inspect a Polymarket tag | mm predict tags get | predict.md |
| Preview a prediction order cost | mm predict quote | predict.md |
| Place a prediction market order | mm predict place | predict.md |
| Cancel prediction orders | mm predict cancel | predict.md |
| View prediction market positions | mm predict positions | predict.md |
| View open prediction orders | mm predict orders | predict.md |
| Show full Predict portfolio snapshot | mm predict portfolio | predict.md |
| List redeemable (winning) positions | mm predict redeem list | predict.md |
| Redeem winning positions | mm predict redeem | predict.md |
| Check Predict deposit wallet balance | mm predict balance | predict.md |
| Fund Predict deposit wallet | mm predict deposit | predict.md |
| Withdraw pUSD from Predict deposit wallet | mm predict withdraw | predict.md |
| Fetch prediction order book | mm predict book | predict.md |
| Watch a Predict job | mm predict watch | predict.md |
| Get a swap or bridge quote | mm swap quote | swap.md |
| Execute a token swap or bridge | mm swap execute | swap.md |
| Check swap or bridge status | mm swap status | swap.md |
| Bridge tokens to another chain | mm swap execute | swap.md |
CLI behavior lives in references/. Repeatable patterns live in workflows/. Load a workflow file when the user's request is a pattern, not a single command.
| Pattern | Workflow |
|---|---|
| First time setup and onboarding | onboarding.md |
| Login flow | login.md |
| Troubleshooting decision tree | troubleshooting.md |
| Swap quote-review-execute flow | swap.md |
| Bridge quote-review-execute flow | bridge.md |
| Open a perpetual position flow | perps-open-position.md |
| Close a perpetual position flow | perps-close-position.md |
| Modify a perpetual position flow | perps-modify-position.md |
| Predict first-time setup and credentials | predict-setup.md |
| Deposit or withdraw pUSD from Predict wallet | predict-funding.md |
| Search and browse prediction markets | predict-markets.md |
| Quote and place a prediction order | predict-place-order.md |
| View or cancel Predict orders and positions | predict-manage-orders.md |
| View Predict portfolio and redeem winnings | predict-portfolio.md |
| Token discovery, prices, and market data | market-data.md |
| Supply assets to Aave V3 | aave-supply.md |
| Withdraw assets from Aave V3 | aave-withdraw.md |
| Borrow from Aave V3 | aave-borrow.md |
| Repay Aave V3 debt | aave-repay.md |
| Toggle Aave V3 collateral | aave-collateral.md |
| Check Aave V3 positions and health factor | aave-positions.md |
| Discover Aave V3 tokens, rates, and liquidity | aave-markets.md |
Every mm command accepts these flags:
| Flag | Short | Description |
|---|---|---|
--format | -f | Output format: text, json, yaml, toml, or toon (defaults to text in TTY, json when piped) |
--json | Shorthand for --format=json | |
--toon | Shorthand for --format=toon | |
--verbose | -v | Show debug logs on stderr. Use for troubleshooting |
Always use --toon for command output unless the user explicitly requests a different format.
Run these checks before the first CLI operation in a session, in order.
This skill is written for @metamask/agentic-cli v1.0.0 (see cliVersion in the frontmatter). Check the installed version:
mm --versionThe installed version is the value after @metamask/agentic-cli/ (e.g. @metamask/agentic-cli/1.0.0 darwin-arm64 node-v24.14.1). Compare its major.minor against the pinned cliVersion. Optionally check the latest published version (best-effort; skip silently on network failure):
npm view @metamask/agentic-cli versionIf the installed major.minor differs from the pinned cliVersion, or the installed version is behind the latest release, warn the user once and continue:
Version mismatch: installed CLI<installed>, this skill is pinned to1.0.0, latest release is<latest>. Command syntax in this skill may be inaccurate until they are aligned. Update the CLI withnpm install -g @metamask/agentic-cli@latest, then re-install the skills withnpx skills add metaMask/agent-skills.
Run this check once per session. Do not block operations on it.
mm auth statusIf the user is not authenticated, follow workflows/onboarding.md for first time setup, or workflows/login.md for login.
These rules apply to every operation, regardless of which reference or workflow is active.
Before constructing any command, validate all user-provided values:
| Flag | Validation rule |
|---|---|
--to, --address | Must match ^0x[0-9a-fA-F]{40}$ |
--amount | Human-readable decimal (e.g. 0.5, 100). Must match ^\d+\.?\d*$. Reject spaces, semicolons, pipes, backticks, or shell metacharacters |
--chain-id | Must be a positive integer (^\d+$) |
--payload (send-transaction) | Must be valid JSON. No unescaped shell metacharacters outside the JSON structure |
--payload (decode) | Must be 0x-prefixed hex calldata, matching ^0x[0-9a-fA-F]+$ |
--token | Must be a valid hex address or known symbol |
--leverage | Must be a positive integer (^\d+$) |
--size | Human-readable decimal (e.g. 0.01, 1). Must match ^\d+\.?\d*$ and be positive |
--venue | Must be hyperliquid |
--side (perps) | Must be long or short |
--order-id | Must be a positive integer (^\d+$) |
--token-id | Must be a non-empty outcome token ID string |
--price, --limit-price | Must be a positive number in range (0, 1] |
--order-type | Must be one of GTC, GTD, FOK, FAK |
--side (predict) | Must be buy or sell |
--slippage | Must be a number between 0 and 100 |
--from-chain, --to-chain | Must be a positive integer EVM chain ID |
--to-address | Must match ^0x[0-9a-fA-F]{40}$. Only valid for cross-chain swaps (--to-chain differs from --from-chain); rejected for same-chain swaps |
--password | Must be a non-empty string. Never log, display, or store the value. |
Do not pass unvalidated user input into any command.
| Operation type | Confirmation rule |
|---|---|
| Transfers | Always confirm recipient, amount, token, and chain before executing |
| Raw transactions | Always confirm transaction payload, chain, recipient, value, and calldata summary before executing |
| Message signing | Always show exact message and chain before signing |
| Typed-data signing | Always show domain, primary type, chain, verifying contract, and message summary before signing |
| Swaps / bridges | Always confirm from/to tokens, amount, source/destination chain, slippage, quoted output, and recipient address (if --to-address is set) before executing |
| Perps trading | Always confirm symbol, side, size, leverage, venue, order type, and limit price if present before executing |
| Perps deposit/withdraw | Always confirm amount, asset, venue, network, and destination where applicable before executing |
| Predict trading | Always confirm token ID, side, size, price, order type, market, and outcome before executing |
| Predict deposit | Always confirm amount before executing |
| Predict withdraw | Always confirm amount and recipient (--to defaults to owner EOA) before executing |
| Predict redeem | Always confirm the target (condition ID or --all) before executing; --all redeems every winning position |
| Cancel-all operations | Always confirm scope and exact destructive effect before executing |
| Auth / wallet management | May execute without confirmation, except reset which requires explicit user confirmation |
| Read-only queries | May execute without confirmation |
--password or --mnemonic as inline flags. Always instruct the user to set the MM_PASSWORD and MM_MNEMONIC environment variables instead to avoid exposing secrets in shell history.Flag to the user before proceeding if a signing payload or transaction contains:
permit, approve, setApprovalForAll, or allowance-like fieldsWhen raw calldata is unfamiliar or was not constructed by you, run mm decode --payload <0x-calldata> first and confirm the decoded intent with the user before signing or sending. See decode.md.
In server-wallet mode, signing and transaction commands return a pollingId instead of an immediate result. Handle this consistently:
--wait to block until complete.--wait, inform the user of the pollingId and how to track it:mm wallet requests listmm wallet requests watch --polling-id <id>MM_PASSWORD environment variable to unlock it for the operation.Transfers, swaps, perps, predict orders, and predict withdraws attach a human-readable intent summary to their wallet request (e.g. Transfer 0.5 ETH to 0x..., Withdraw 10 pUSD to 0x...). When surfacing a pending request from wallet requests list or wallet requests watch, show the intent summary so the user can confirm what they are approving.
mm <command> --help and guide from there.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.