jaw-sdk-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill guides the agent in developing applications that ingest data from external sources (e.g., backend API responses in rules/siwe.md, ENS records in rules/ens-identity.md, and user-provided transaction details in rules/transactions.md). While the skill advocates for best practices like backend verification and standardized encoding, this data ingestion combined with capabilities like transaction execution and signing creates a potential surface for indirect prompt injection.
- Ingestion points: Data enters the context via fetch calls to backend endpoints for nonces and verification results, as well as through resolution of external ENS profiles.
- Boundary markers: The instructions do not explicitly mandate specific delimiters or 'ignore' instructions for untrusted data when passed to the LLM agent, though they do use standard coding patterns.
- Capability inventory: The skill enables full smart account management, including sendCalls for transactions, signMessage for cryptographic signing, and grant permissions for session management.
- Sanitization: The instructions emphasize protocol-level sanitization, such as using viem to verify SIWE signatures and encode function data, ensuring data integrity at the execution layer.
- [SAFE]: The skill demonstrates security best practices by advising the use of environment variables for API keys and private keys, preventing accidental hardcoding of sensitive credentials.
- [SAFE]: External dependencies and service references (e.g., Pimlico, Etherspot, Privy, Turnkey) are well-known, established services within the blockchain ecosystem, and the SDK packages are provided by the skill's authoring organization.
Audit Metadata