sui-ts-sdk-backend
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs developers to install official Sui developer tools including
@mysten/sui,@mysten/aws-kms-signer,@mysten/gcp-kms-signer, and@mysten-incubation/sponsorfrom the npm registry. These are verified vendor-owned resources for interacting with the Sui blockchain.\n- [CREDENTIALS_UNSAFE]: While the documentation demonstrates how to load private keys from environment variables for local testing, it provides strong security guidance to use AWS or GCP KMS signers for production environments to ensure private keys never leave secure cloud storage.\n- [INDIRECT_PROMPT_INJECTION]: The sponsorship and transaction workflows describe patterns where an agent or backend ingests transaction bytes from untrusted external sources. \n - Ingestion points: Sponsorship backends receive transaction bytes and user signatures for co-signing (
sponsorship.md). \n - Boundary markers: The skill relies on programmatic logic validation rather than text-based delimiters. \n
- Capability inventory: The skill uses
signAndExecuteTransactionandexecuteTransactionto commit state changes to the blockchain. \n - Sanitization: The documentation explicitly advises developers to implement strict validation checks (e.g., verifying transaction targets and amounts) before co-signing user-provided data, which mitigates injection risks.
Audit Metadata