jaw-sdk-best-practices

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The content includes explicit instructions that bypass authentication and enable silent/session-less operations (notably using overrideSignatureCheck: true for JustaName to "bypass SIWE authentication" and Account.get silent restores), plus server-side flows that programmatically execute delegated charges, which together create clear avenues for unauthorized ENS issuance, automated exfiltration/charges, or backdoor-style abuse.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The JAW SDK documentation explicitly describes on-chain wallet and transaction functionality: "Sending transactions (single or batched) through JAW smart accounts", "Signing messages or typed data", "Implementing subscription payments or recurring charges", "Setting up gas sponsoring with paymasters", "Building headless integrations, server-side operations, or AI agent wallets", and "Building stablecoin payment flows (USDC gas, batch payouts)". These are specific crypto/blockchain financial capabilities (wallets, signing, sending transactions, subscription payments, stablecoin payouts, paymasters) that enable direct movement of funds and automated payment flows. This meets the criterion for Direct Financial Execution.