moss-skills

Use the MegaETH Wallet CLI to connect a MegaETH passkey wallet, create/manage scoped delegated session keys, inspect permissions, and use those keys for read-only calls, transfers, and relay-backed execution on MegaETH.

Configures MOSS gas sponsorship and the partner paymaster endpoint on MegaETH. Use when sponsoring gas for users: set sponsorUrl, sponsorMode (app-only default, explicit, or everything), and sponsorToken (native or usdm) in mega.initialise() or MegaProvider, and build the backend sponsor endpoint that validates the request, enforces contract allowlists, budget caps, and rate limits, then signs or rejects. Use explicit mode with per-call sponsor: true for onboarding-only sponsorship. Encodes the rule that sponsorship policy stays server-side and everything mode is testing-only.

Designs and implements MOSS Smart Approvals — session-key permission grants for delegated and silent execution on MegaETH. Use when an integration needs mega.grantPermissions(), mega.getPermissions(), mega.revokePermissions(), or callContract({ silent: true }), or when building AI-agent loops, game automation, recurring spends, or checkout flows that run without per-action prompts. Encodes the canonical { to, signature } call matcher plus scoped spend limits with a period, short expiry windows, least-privilege defaults, and a revocation plan. Explains that silent: true only works against a matching grant and otherwise falls back to wallet UI.

Builds a guided wizard that moves a user's assets from a Privy embedded wallet into a new MOSS account on MegaETH. Use when migrating users off Privy: create or connect the MOSS account with mega.initialise() + mega.connect() to get the destination address, then transfer assets from the Privy EOA (Privy signs and broadcasts). Encodes the critical ordering — ERC-20s first, NFTs next, native token last minus a gas reserve — plus an asset allowlist, per-transfer state tracking with resumable partial completion, and the hard rule never to export, request, or move private keys or seed phrases. This is an asset migration, not a key migration.

Integrates MOSS into React 19 apps with @megaeth-labs/wallet-sdk-react (TanStack Query 5). Use when wiring MegaProvider and hooks — useStatus, useConnect, useTransfer, useSend, useSwap, useCallContract, useGetFromContract, useSignMessage, useAuthenticate, useGrantPermissions, useRevokePermissions, useDeposit, useBalances, usePermissions — or when an app already uses wagmi/viem and wants the @megaeth-labs/wallet-wagmi-connector instead. Covers mutation vs query hook semantics (mutateAsync, isPending), the shared balances query key, SSR/Next.js client-only initialisation, and gating UI on the initialised flag.

Builds MOSS embedded-wallet integrations on MegaETH with the @megaeth-labs/wallet-sdk core SDK (the `mega` object). Use when implementing or debugging wallet connect, disconnect, status, transfer, send, swap, callContract, getFromContract, signMessage, signData, balances, or deposit in any JS/TS app (vanilla, Vue, Svelte, Node). Covers mega.initialise() config (network, sponsorUrl), the secure-context/passkey requirement, and the three-way approved/cancelled/error result contract that methods return instead of throwing. Acts as the entry point that routes to the React, permissions, server-verify, paymaster, CLI, Privy-migration, and security-review skills for specialized work.

Reviews an existing MOSS wallet integration for security and correctness before launch on MegaETH. Use when auditing partner code rather than building it: produces findings grouped as Critical, Risky defaults, and Recommendations with concrete remediations. Checks for frontend-owned trust decisions, missing backend SIWE/JWT verification, over-broad or long-lived permission grants, to-only call matching, unguarded silent: true usage, unrestricted sponsor endpoints (no allowlist/budget/rate limit), unhandled cancelled/error results, insecure-context passkey failures, and persisted session-key material in frontend storage.

Verifies MOSS wallet ownership on the backend with @megaeth-labs/wallet-server-verify (SIWE, viem + porto). Use when implementing wallet-backed login or session issuance: generate a challenge with getMessageToSign(config, address), have the client sign it via mega.signMessage(), and confirm with verifySignature(config, messageToConfirm), which throws DIFFERENT_MESSAGE or INVALID_SIGNATURE on mismatch. Also covers the JWT path — mega.authenticate() returns a JWT verified at the partner-auth endpoint. Encodes nonce/challenge storage, single-use challenges, correct chainId (mainnet 4326, testnet 6343), and the rule to never trust client-only signature checks.