megaeth-developer
End-to-end MegaETH development playbook (Feb 2026). Covers wallet operations, token swaps (Kyber Network), eth_sendRawTransactionSync (EIP-7966) for instant receipts, JSON-RPC batching, real-time mini-block subscriptions, storage-aware contract patterns (Solady RedBlackTreeLib), MegaEVM gas model, WebSocket keepalive, bridging from Ethereum, and debugging with mega-evme. Use when building on MegaETH, managing wallets, sending transactions, or deploying contracts.
87
82%
Does it follow best practices?
Impact
91%
2.06xAverage score across 3 eval scenarios
Advisory
Suggest reviewing before use
Security
2 findings — 2 medium severity. This skill can be installed but you should review these findings before use.
W011: Third-party content exposure detected (indirect prompt injection risk)
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
Third-party content exposure detected (high risk: 0.90). The skill explicitly instructs the agent to fetch and act on live third‑party API/RPC/WebSocket data — e.g., wallet-operations.md calls the Kyber aggregator API (https://aggregator-api.kyberswap.com/megaeth/api/v1) to build transaction data and frontend-patterns.md / rpc-methods.md show connecting to public RPCs and wss://mainnet.megaeth.com/ws to consume miniBlock messages — and those JSON/websocket responses are parsed and used to build/send transactions, so external (third‑party) content can directly influence tool actions.
W009: Direct money access capability detected (payment gateways, crypto, banking)
What this means
The skill is specifically designed for direct financial operations, giving the agent the ability to move money or execute financial transactions — such as payment processing, cryptocurrency operations, banking integrations, or market order execution.
Why it was flagged
Direct money access detected (high risk: 1.00). The skill is explicitly designed for blockchain financial operations. It includes wallet setup/management, signing and submitting transactions (eth_sendRawTransactionSync / "sign locally → eth_sendRawTransactionSync"), token swaps via the Kyber Network aggregator, bridging ETH, and RPC methods for sending and monitoring transactions. These are specific crypto/blockchain execution capabilities (wallets, swaps, signing, transaction submission), so it grants direct financial execution authority.
- Repository
- Demerzels-lab/elsamultiskillagent
- Commit
f45fcb5
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.