jovay-interaction

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:23 AM UTC
• Version: 0.0.1

Overview

The skill does what it claims, but it guides users to handle blockchain wallet secrets in ways that can expose funds.

Review this skill carefully before installing. Do not paste real private keys or wallet passwords into chat, shell commands, scripts, or logs. Use test wallets first, verify every recipient, spender, contract, network, value, and broadcast flag, and prefer safer signing methods if jovay-cli supports them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Third-Party CLI Handles Private Keys and Blockchain Transactions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–16 and line 31
Vulnerability Type: Insecure third-party dependency and supply-chain exposure
Risk Level: Medium

Vulnerable Code Snippet

yaml

metadata:
  {
    "openclaw": {
        "emoji": "🔧",
        "requires": { "bins": ["jovay"] },
        "install": [{
          "id": "npm",
          "kind": "npm",
          "package": "@jovaylabs/jovay-cli",
          "bins": ["jovay"],
          "label": "Install jovay-cli (npm)"
        }]   
    }
  }

markdown

- jovay-cli installed (`npm install -g @jovaylabs/jovay-cli`)

Technical Analysis

The Skill installs and fully trusts the external @jovaylabs/jovay-cli npm package without specifying an exact version or package integrity hash. It also recommends global installation. No source code, lockfile, or integrity metadata for this dependency is present in the audited project.

The external executable is subsequently trusted to process private keys and encryption passwords, sign transactions, grant token allowances, interact with arbitrary contracts, bridge assets, and broadcast irreversible blockchain transactions. Because the package implementation was not included in the audit, its behavior cannot be verified from this project alone.

This is a supply-chain risk rather than proof that the named package is malicious. However, a compromised publisher account, registry package, release pipeline, or mutable future version could introduce code that steals wallet credentials or changes transaction parameters.

Attack Path

1. An attacker compromises the npm package, its publisher credentials, or its release pipeline.
2. A malicious version is published under the same unpinned package name.
3. The user follows the Skill instructions and globally installs the package.
4. The user supplies wallet credentials or requests a transfer, approval, bridge operation, o ...[truncated 933 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed, exact version rather than resolving the latest available release.
2. Commit a lockfile and verify registry integrity metadata during installation.
3. Verify package provenance, signatures, publisher identity, and release-pipeline security.
4. Prefer a project-local installation with a controlled execution path instead of a global installation.
5. Review or vendor the dependency source used for security-sensitive wallet and transaction operations.
6. Run the CLI with minimum operating-system privileges and isolate it from unrelated credentials and files.
7. Require users to inspect the network, chain ID, recipient, spender, contract address, calldata, value, and fees on a trusted display before signing or broadcasting.
8. Consider hardware-wallet support so the third-party CLI never directly receives exportable private keys.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:61

Finding

Wallet Secrets Are Passed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 61–76, 116–117, 132–133, 153–154, 173–174, 194–195, 211–212, 265–266, and 496–505
Vulnerability Type: Exposure of private keys and encryption passwords through process arguments and command history
Risk Level: Medium

Vulnerable Code Snippet

markdown

4. Configure wallet: `jovay wallet set --sk <private-key> [--enc]`

bash

jovay wallet set --sk <private-key> [--enc] [--enc-key <password>]

markdown

- `--sk, --secret-key <key>`: Private key (64 hex characters, with or without 0x prefix)
- `--enc`: Enable encryption with auto-generated key (save the key!)
- `--enc-key <password>`: Custom encryption password (auto-enables encryption)

The same secret-bearing options are documented repeatedly for sensitive transaction operations:

markdown

- `--sk <key>`: Override wallet private key
- `--enc-key <password>`: Encryption key for encrypted wallet

The Skill also provides an explicit password-bearing example:

bash

jovay contract write \
  --contract 0x<contract-address> \
  --method setApprovalForAll \
  --inputs "address,bool" \
  --args '"0x<operator>", true' \
  --enc-key "your-encryption-password" \
  --broadcast

Technical Analysis

Supplying a wallet private key or encryption password as a command-line argument can expose it outside the intended process. Depending on the host and execution environment, complete commands may be retained in shell history, terminal transcripts, Agent tool-call records, observability systems, debugging output, process accounting, or session logs. Other local processes or users may also be able to inspect process arguments while the command is running.

Encryption at rest does not adequately mitigate this issue when the decryption password itself is supplied through an observable argument. The repeated use ...[truncated 1465 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace command-line secret arguments with protected interactive prompts that disable terminal echo.
2. Support hardware wallets, operating-system keychains, or external signing providers so private keys are not exposed to the CLI.
3. Where automation is unavoidable, read secrets from permission-restricted file descriptors or another secret-delivery mechanism that does not place values in process arguments.
4. Explicitly warn users never to paste private keys or encryption passwords into chat messages, shell history, scripts, CI configuration, or Agent tool calls.
5. Redact sensitive flags and values from application logs, telemetry, exception reports, and diagnostic output.
6. Avoid demonstrating literal password placement in commands. Replace the example with an interactive or hardware-backed signing workflow.
7. Document shell-history cleanup only as defense in depth; it is not a substitute for preventing argument exposure.
8. Rotate any wallet credential that may already have appeared in process arguments, logs, transcripts, or shared terminal history.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs users to pass a private key directly on the command line via jovay wallet set --sk <private-key> and also allows --sk <key> on other transaction commands. Command-line arguments are commonly exposed through shell history, process listings, terminal logs, agent transcripts, and telemetry, so this pattern can directly leak the wallet secret and enable theft of all associated funds.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.