juicy

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:27 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed Juicebox development toolkit, but several wallet-connected templates have security weaknesses users should review before installing.

Install only if you will treat these as review-required templates, not production-safe code. Before using generated wallet UIs, pin or bundle dependencies, avoid mutable Solidity imports, sanitize all chain and metadata fields, add explicit confirmation screens for every wallet action, and avoid unlimited token approvals unless the user knowingly accepts that risk.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T08 · Insecure Dependencies

Error

• Location: jb-deploy-ui/SKILL.md:76

Finding

Unpinned Remote JavaScript Executes in Wallet-Connected Applications

Content

View full analysis

``` Other affected examples similarly import wallet, transaction-encoding, blockchain-client, and contract utilities from unversioned `https://esm.sh/viem` URLs. ### Technical Analysis The generated browser applications execute JavaScript obtained directly from third-party CDNs. The `esm.sh` imports do not specify an immutable package version or content hash. The jsDelivr URL only pins the dependency to the broad major version `6`, allowing later releases within that range to change the effective code after the Skill has been reviewed. This is particularly dangerous because the affected pages interact with injected wallet providers and perform security-sensitive actions such as: - Constructing transaction calldata - Selecting transaction targets and chains - Requesting wallet signatures - Deploying contracts - Displaying transaction values and destinations - Submitting cross-chain transaction bundles A compromised CDN, package release, DNS route, or upstream package could therefore execute with the same browser privileges as the generated application. ### Attack Path 1. A user ge ...[truncated 1338 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: jb-hook-deploy-ui/SKILL.md:551

Finding

Mutable Remote Solidity Imports Can Alter Wallet-Deployed Bytecode

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: jb-nft-gallery-ui/SKILL.md:350

Finding

Attacker-Controlled NFT Metadata Causes Stored DOM Cross-Site Scripting

Content

View full analysis

{ const tier = nft.tier; const name = nft.metadata?.name || `Tier ${nft.tierId} #${nft.tokenId}`; const image = nft.metadata?.image; html += `

${image ? `` : '

NFT

'}

Tier ${nft.tierId}

${name}

Token ID: ${nft.tokenId}

${tier ? formatEther(tier.price) + ' ETH' : '-'}

${tier?.votingUnits > 0 ? `

${tier.votingUnits} votes

` : ''}

`; }); container.innerHTML = html + ''; ``` Attribute values are also rendered with `innerHTML`: ```javascript if (nft.metadata?.attributes) { nft.metadata.attributes.forEach(attr => { ...[truncated 2206 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: jb-event-explorer-ui/SKILL.md:330

Finding

On-Chain Event Memos Cause Stored DOM Cross-Site Scripting

Content

View full analysis

renderEvent(event, start + i) ).join(''); ``` The event summary is included directly in the generated markup: ```javascript function renderEvent(event, index) { const badge = getEventBadge(event.name); const summary = getEventSummary(event); const details = getEventDetails(event); const timeAgo = formatTimeAgo(event.timestamp); const explorer = CHAINS[event.chainId]?.explorer || 'https://etherscan.io'; return `

${badge.label} ${summary.title}

${timeAgo}

${summary.description}

${details.map(d => `

${d.label} ${d.value}

`).join('')}

Transaction ${event.txHash.slice(0, 10)}...${event.txHash.slice(-8)}

`; } ``` The description contains the unescaped event memo: ```javascript case 'Pay': return { title: `Project ${args. ...[truncated 2042 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: jb-bendystraw/SKILL.md:2171

Finding

Bendystraw API Credentials Are Exposed in URL Paths

Content

View full analysis

Remediation

View remediation

``` 2. If a custom header is required, use a clearly designated header such as `X-API-Key`. 3. Keep credential-bearing requests on trusted server-side infrastructure rather than in browser code. 4. Configure all proxies, servers, and monitoring systems to redact authorization data. 5. Use scoped API keys with minimal permissions, rate limits, and short expiration periods. 6. Rotate keys that may already have appeared in URL logs. 7. Prevent request objects and headers from being included in exception reports. 8. Document that API keys must never be embedded into client-side bundles or publicly generated HTML. ]]>

T08 · Insecure Dependencies

Warning

• Location: jb-permit2-metadata/SKILL.md:24

Finding

Mandatory Metadata Helper Dependency Is Installed Without a Version Pin

Content

View full analysis

Remediation

View remediation

``` 2. Commit and review the generated lockfile. 3. Use `npm ci` in automated environments so the lockfile is enforced. 4. Use `--ignore-scripts` where package functionality does not require lifecycle scripts. 5. Verify npm integrity and provenance information before installation. 6. Review direct and transitive dependencies with an appropriate software-composition analysis tool. 7. Test metadata output against independent Solidity or protocol test vectors. 8. Require security review before updating the pinned version or lockfile. 9. Consider vendoring the minimal audited metadata-construction implementation if long-term reproducibility is required. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (52)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · jb-event-explorer-ui/SKILL.md (reported line 68)May include surrounding context.

md

<h1>Event Explorer</h1>
    <p class="subtitle">Browse all Juicebox project events</p>

    <!-- Filters -->
    <div class="card">
      <div class="filters">
        <div class="filter-group">

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document repeatedly states that a Juicebox project must be identified by projectId + chainId + version, but the nearby example queries omit version when fetching a single project. In a cross-chain, multi-version protocol integration skill, this inconsistency can cause consumers to retrieve or display the wrong project data, mix V4/V5 state, or make downstream decisions using mismatched protocol context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The getProject helper encodes an unsafe abstraction by accepting only projectId and chainId despite the document's own critical guidance that version is required to uniquely identify projects. Because this helper is positioned as reusable reference code, developers are likely to copy it directly into production workflows, where it can silently target the wrong protocol version and corrupt analytics, UI logic, or transaction preparation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This section is presented as a '721 NFT Project Deployment' template and exposes a 'Deploy NFT Project' action, which implies actual onchain deployment behavior. In the implementation, the deploy handler only shows an alert, reports success text, and logs data to the console, explicitly stating that full deployment is not implemented.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The section is titled 'Template: Revnet Deployment' and the UI presents a 'Deploy Revnet' button, suggesting the code will launch a revnet. However, the handler only builds a config object, logs it, shows a readiness message, and alerts users to see other skills for complete deployment scripts.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · jb-docs/SKILL.md (reported line 33)May include surrounding context.

Direct MCP Call Example

bash

curl -X POST https://docs.juicebox.money/api/mcp-sse \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"search_docs","arguments":{"query":"pay hook"}}}'

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest and overview text say the skill can 'decode ... all JB events' and 'Browse, filter, and decode all Juicebox protocol events'. In code, EVENT_ABIS only defines six event signatures, so many referenced Juicebox events are not actually decoded and are skipped when parsing fails.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The 'Event Types Reference' documents events such as UseAllowance, AddToBalance, BurnTokens, and SendReservedTokensToSplits. However, the decoder configuration at L172-L179 and filter UI at L89-L97 do not implement these event types, so the documentation overstates actual functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This skill explicitly enables arbitrary contract write transactions and payable calls through a generic explorer UI, but it provides no built-in warning, confirmation language, allowlisting, or transaction-risk explanation to the user. In this context, users may be prompted to sign irreversible transactions or send ETH to unknown contracts based only on fetched ABIs, which materially increases the chance of unsafe signing and value loss.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest and introductory text present hook attachment as a built-in capability of this UI. But the only 'attach' behavior is a status message at L490-L497 instructing the user to use JBController.queueRulesetsOf() via another skill, so the actual behavior falls short of the claimed end-to-end attachment functionality.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest description claims the skill will 'attach to projects,' and the page copy repeats 'attach to your Juicebox project.' However, the implemented attach action at L485-L499 merely shows guidance telling the user to call JBController.queueRulesetsOf() elsewhere, without submitting any on-chain action. This is an active contradiction between stated behavior and implemented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This skill facilitates contract deployment from a connected wallet yet lacks a prominent warning that deployment causes real blockchain transactions, gas expenditure, and irreversible state changes. In a browser UI that compiles arbitrary Solidity and deploys it across multiple chains, that omission materially increases the risk of accidental mainnet deployment or user approval of costly actions without informed consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation explicitly states compilation happens in the browser with solc.js. In practice, compileSource() posts the Solidity source to /api/compile at L332-L336, and the documented backend endpoint at L521-L545 performs the compilation server-side with solc. This is a direct contradiction, not just an omitted detail.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest and introductory text frame this skill as generating minimal frontends for paying, cashing out, claiming tokens, and viewing project state on existing Juicebox projects. However, the Project Admin UI adds privileged management actions like sending payouts, withdrawing surplus allowance, and distributing reserved tokens, which goes beyond ordinary interaction and into project administration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The admin UI exposes treasury payout and allowance-withdrawal actions without prominent, action-specific warnings about their financial and potentially irreversible consequences. In a wallet-connected blockchain UI, weak UX around privileged fund-moving actions increases the risk of operator mistakes, social engineering success, or accidental confirmation of unintended withdrawals.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Reserved-token distribution is a privileged state-changing action with treasury/governance consequences, but the UI presents it as a simple button without a clear warning or confirmation flow. That creates avoidable risk of accidental execution by an authorized owner, especially in a template intended for rapid reuse and minimal frontends.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The cash-out modal example documents that users must see the project's actual return currency, but the sample component defaults currencySymbol to 'ETH' for backwards compatibility. In a financial/protocol UI skill, this inconsistency can cause integrators to ship misleading displays where USDC-denominated cash-outs are shown as ETH, leading to user confusion, incorrect transaction expectations, and potential loss through mistaken decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The UI exposes a live on-chain transferFrom action through transferNFT() and the skill advertises transfer functionality, but there is no prominent warning that NFT transfers are blockchain transactions that are typically irreversible once confirmed. In a wallet-connected NFT management interface, this omission can mislead users into treating transfers like reversible web actions, increasing the chance of accidental asset loss from mistyped recipient addresses or misunderstanding of finality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The deployment template signs typed data for multiple chains and sends a real on-chain payment, but it does not present a clear user-facing warning that these actions may spend funds and trigger irreversible cross-chain deployments. In a blockchain deployment skill, omission of transaction-risk disclosure increases the chance of user mis-consent, especially because the flow bundles multiple chain actions behind a single payment UX.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · jb-patterns/SKILL.md (reported line 14)May include surrounding context.

md

# Juicebox V5 Design Patterns

Proven patterns for common use cases using native Juicebox mechanics. **Always prefer configuration over custom contracts.**

## Golden Rule

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill recommends transferring project ownership to a burn address to create an immutable treasury, but it does not strongly foreground that this action is irreversible and permanently removes administrative recovery paths. In a protocol operations skill, readers may copy this pattern into production and unintentionally lock themselves out of upgrades, emergency response, or misconfiguration fixes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The transfer-tax token pattern presents fee-on-transfer behavior as a supported customization without a prominent warning that ordinary holders lose value on each transfer and that such mechanics can break user expectations and integrations. In a DeFi/token-design skill, this omission can lead developers to deploy economically harmful tokens without adequate disclosure to users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The cash-out wrapper examples bridge or swap redeemed funds but do not explicitly warn that this introduces third-party bridge/DEX risk, slippage, settlement failure, and potential asset loss relative to direct redemption. Because these wrappers compose external protocols after a cash-out, users may face materially different risk than the base terminal behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The Aave yield-hook pattern frames principal-protected yield behavior without clearly warning that external DeFi dependencies can fail, pause withdrawals, depeg, or otherwise impair access to principal. In treasury-management guidance, this omission is dangerous because readers may treat principal availability as stronger than it really is.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly recommends approving maxUint256 to the Permit2 contract as a one-time setup, but it does not warn users that this creates a persistent, effectively unlimited spending authorization for that token. If the approved spender path is later abused through compromised frontends, malicious terminal selection, user signing mistakes, or unexpected integrations, users can lose their token balances without needing to issue a fresh approval.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: jb-hook-deploy-ui/SKILL.md:462