jovay-interaction

This skill is coherent for interacting with Jovay via jovay-cli, but double-check the following before installing or using it: - Trust and origin: the skill's source/homepage is not provided here. Verify you are installing the official @jovaylabs/jovay-cli package (check the npm package page, repository, and maintainers) before running npm -g installs. - Secrets handling: the CLI accepts private keys via --sk (command-line flag). Avoid pasting raw private keys on command lines or into agents: command history and process lists can leak them. Prefer encrypted wallets, hardware wallets, or temporary wallets with minimal funds for testing. - Broadcasting risk: the skill's instructions include --broadcast and bridge/transfer commands. If you supply a private key to an agent or allow autonomous invocation, the agent could sign and submit transactions. Only enable autonomous usage if you trust the skill and have constrained the key's permissions/funds. - Supply-chain caution: installing an npm CLI is common but not risk-free. Inspect the npm package repo, release notes, and maintainers, or install from a known-good release/tag. - Mitigations: use a dedicated low-value wallet for experimentation, use RPC endpoints you trust, prefer encrypted key storage (--enc) or hardware wallets, and do not store long-term secrets in the agent or in plain shell history. If you can provide the package repository or homepage, that would raise confidence and allow a more precise assessment.