metamask-agent-workflows — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited metamask-agent-workflows (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Repeatable multi-step patterns for the mm CLI. Load a workflow file when the user's request is a pattern, not a single command.
| Pattern | Workflow |
|---|---|
| First time setup and onboarding | onboarding.md |
| Login flow | login.md |
| Troubleshooting decision tree | troubleshooting.md |
| Swap quote-review-execute flow | swap.md |
| Bridge quote-review-execute flow | bridge.md |
| Open a perpetual position flow | perps-open-position.md |
| Close a perpetual position flow | perps-close-position.md |
| Modify a perpetual position flow | perps-modify-position.md |
| Predict first-time setup and credentials | predict-setup.md |
| Deposit or withdraw pUSD from Predict wallet | predict-funding.md |
| Search and browse prediction markets | predict-markets.md |
| Quote and place a prediction order | predict-place-order.md |
| View or cancel Predict orders and positions | predict-manage-orders.md |
| View Predict portfolio and redeem winnings | predict-portfolio.md |
| Token discovery, prices, and market data | market-data.md |
| Supply assets to Aave V3 | aave-supply.md |
| Withdraw assets from Aave V3 | aave-withdraw.md |
| Borrow from Aave V3 | aave-borrow.md |
| Repay Aave V3 debt | aave-repay.md |
| Toggle Aave V3 collateral | aave-collateral.md |
| Check Aave V3 positions and health factor | aave-positions.md |
| Discover Aave V3 tokens, rates, and liquidity | aave-markets.md |
Always use --toon for command output unless the user explicitly requests a different format.
Run these checks before the first CLI operation in a session, in order.
This skill is written for @metamask/agentic-cli v1.0.0 (see cliVersion in the frontmatter). Check the installed version:
mm --versionThe installed version is the value after @metamask/agentic-cli/ (e.g. @metamask/agentic-cli/1.0.0 darwin-arm64 node-v24.14.1). Compare its major.minor against the pinned cliVersion. Optionally check the latest published version (best-effort; skip silently on network failure):
npm view @metamask/agentic-cli versionIf the installed major.minor differs from the pinned cliVersion, or the installed version is behind the latest release, warn the user once and continue:
Version mismatch: installed CLI<installed>, this skill is pinned to1.0.0, latest release is<latest>. Command syntax in this skill may be inaccurate until they are aligned. Update the CLI withnpm install -g @metamask/agentic-cli@latest, then re-install the skills withnpx skills add metaMask/agent-skills.
Run this check once per session. Do not block operations on it.
mm auth statusIf the user is not authenticated, follow workflows/onboarding.md for first time setup, or workflows/login.md for login.
Before constructing any command, run mm <command> --help to confirm the exact flags, syntax, and defaults. Do not guess flags from memory.
mm <command> --help and guide from there.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.