ClawHub
Back to skill

Security audit

jovay-dapp-skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Jovay blockchain dApp builder, with expected wallet and deployment workflows that users should handle carefully.

Install only if you intend to build Jovay blockchain dApps. Use a dedicated low-value testnet wallet, review generated contracts and deployment scripts before signing anything, confirm the network is testnet unless you explicitly want mainnet, and do not paste production private keys into chat, shell commands, logs, or frontend code.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The activation condition is effectively any user asking to build or generate a dApp, which is a broad, common request that can overlap with many unrelated development tasks. In an agent environment, this can cause the skill to auto-activate unexpectedly and start steering users into blockchain project initialization, dependency installation, deployment, and wallet-related workflows without clear intent confirmation.

Static analysis

No suspicious patterns detected.