Agent skill · security · aiskillstore
agent-wallet
Give the AI agent its own EVM wallet with admin-controlled policies the agent CANNOT bypass even under prompt injection. Encrypted keystore (AES-256-GCM, scrypt KDF), policy file the agent has no tool to write, deterministic policy gate on every signing operation, optional local HTTP dashboard. Triggers: agent wallet, give the agent a wallet, agent address, fund the agent, agent autonomy, policy gate, kill switch, agent permissions, bounded autonomy, ERC-4337 alternative, session-key alternative.
Why this skill is useful
Adds a secure EVM wallet implementation with admin-controlled policies that prevent unauthorized access, enhancing the agent's capabilities in handling cryptocurrency securely.
What it needs
Requires chaingpt installed locally. About 10k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
ChainGPT Agent Wallet Skill The agent has its own EOA wallet on every EVM chain it supports. The admin (you, in your shell) sets policies that the agent cannot violate or revoke — even if a malicious prompt convinces the LLM to try. Threat model The attacker's goal: prompt-inject the agent to drain its wallet to an attacker address. The plugin's defense: the policy check is in code, not in the LLM's prompt. Every chaingptagentwalletsignandsend call: 1. Loads the policy file fresh from disk (no caching — admin can update mid-session). 2. Runs checkPolicy(intent) — pure deterministic code that doesn't see the LLM's context. 3. Refuses if any rule fails, with a clear reason the agent surfaces back to the user. The attacker can convince the LLM to call signandsend(to=attacker, value=ALL) — but the tool layer refuses because attacker isn't in allowedToAddresses or value exceeds maxTxValueWei or killSwitch=true. The trust boundary is the tool code, not the LLM. There is no MCP tool that writes the policy file. The admin edits it directly with a text editor. There is no MCP tool that reads or sets the passphrase. The passphrase lives only in the shell env var or the OS keychain — never in the keystore file, never in the LLM's context. Setup (admin steps — done once) The keystore passphrase resolves in this priority order: 1. CHAINGPTAGENTWALLETPASSPHRASE env var — explicit override. Best for CI / headless / power users who want zero process-list and zero keychain exposure. 2. OS keychain — auto-managed. On macOS (Keychain via security) or Linux (libsecret via secret-tool), if no env var is set, chaingptagentwalletinit generates a strong 256-bit passphrase and stores it in the keychain. You never type or remember it; the MCP server reads it back on each load. Option A — zero-setup (macOS / Linux with a keychain) — recommended for most The init output tells you it used the keychain and how to export the passphrase for backup. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/agent-wallet