security

A security guide for building non-custodial crypto wallets, where users control their own keys and approve transactions themselves.

In plain words
What is it for?
Use it when designing mnemonic or private-key handling, transaction signing, token approvals, decentralized-app connections, transaction history, or risk warnings.
Why use it?
Wallet features can expose users to stolen keys, malicious contracts, misleading transaction requests, or unsafe approvals if risks are not handled carefully.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/consenlabs/token-ui/security
Any agent
npx skills add consenlabs/token-ui --skill security
Clone the repo
git clone --depth 1 https://github.com/consenlabs/token-ui

Made for: Claude Code, Codex.

Per session 0 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,516 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.02516
Opus 5 $0.00000 $0.01258
Sonnet 5 $0.00000 $0.00503
Haiku 4.5 $0.00000 $0.00252

Measured 2d ago against content hash 21478095315c, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

security/SKILL.md · 266 lines

How it starts

The opening of the file, as written. The whole thing — 266 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Wallet Risk Control — Security Skill

When to Use This Skill

Read and apply this skill whenever you are helping a user build a non-custodial crypto wallet or wallet-related application and the conversation touches any of the following:

  • Mnemonic phrase or private key handling (generation, display, import, export)
  • Transaction signing flows (eth_sign, personal_sign, signTypedData)
  • Token approval or authorization flows (ERC-20 approve, Permit, Permit2)
  • DApp interaction (WalletConnect, injected provider, DApp browser)
  • Transaction history or address display
  • Risk-related UI components (warning banner, confirmation modal, risk badge)
  • User safety questions ("how do I protect users from X", "should I warn the user about Y")

Do not apply this skill for general blockchain education unrelated to wallet UX or security implementation.


1. Core Threat Reference

The following attack categories are directly relevant to EVM web wallets built during this activity. Use these definitions to reason about whether a wallet feature introduces risk and what mitigations to suggest.

1.1 Malicious Contract Interaction & Blind Signing

Definition: Attackers induce users to sign cryptographically valid transactions or messages whose business logic (approve, Permit, Permit2) results in asset theft. Users cannot read raw calldata, creating an information asymmetry the attacker exploits.

Key risks for builders:

  • ERC-20 approve with unlimited allowance (uint256 max) presented without clear warning
  • Permit / Permit2 off-chain signatures that look identical to harmless "login" prompts
  • Transaction calldata displayed as raw hex with no human-readable decode

Builder checklist:

  • Always decode and display before the sign button is active: function name, contract address (with verification status), token, and exact approval amount
  • Flag unlimited allowance with a Danger-level warning (see Section 2.2)
  • Visually distinguish Permit / Permit2 signatures from login signatures in the UI
  • Provide a user-editable amount field so users can reduce approvals to the exact amount needed
  • Use Token Core CLI analyze to decode calldata before presenting to the user (see Section 4)

Read the full file on GitHub · 266 lines

Files

What ships with it

2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 266 lines · 0 tokens per session scan A 21478095315c

Subscribe to this mod's changes

security is a skill published in the GitHub repository consenlabs/token-ui (5 stars, last pushed 1mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,516 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.