sui-walrus

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill instructs the user to install official utilities by piping a remote script to a shell (curl | sh) from the Mysten Labs GitHub repository. It also downloads and executes binaries for the site-builder tool from a Google Cloud Storage bucket owned by the vendor.
  • [CREDENTIALS_UNSAFE]: The documentation describes how to extract and Base64-encode the Sui keystore file (~/.sui/sui_config/sui.keystore) for use as a secret in automated CI/CD pipelines. This process involves handling private keys that provide full control over Sui network accounts and assets.
  • [INDIRECT_PROMPT_INJECTION]: The skill enables the agent to read content from decentralized Walrus blobs, which are external and untrusted data sources.
  • Ingestion points: Data is read using the @mysten/walrus SDK or via Aggregator HTTP APIs.
  • Boundary markers: The provided patterns do not explicitly enforce delimiters or isolation when the agent processes the retrieved blob content.
  • Capability inventory: The skill allows transaction signing, file system writes via CLI tools, and network communication with storage nodes.
  • Sanitization: No specific content sanitization or validation logic is detailed for the blob payloads.
  • [DYNAMIC_EXECUTION]: The integration requires loading WebAssembly (WASM) modules at runtime, with options to fetch these modules from external Content Delivery Networks (CDNs) like unpkg.com to support blob processing.
  • [PRIVILEGE_ESCALATION]: Instructions for setting up custom domains include the use of administrative commands (sudo) for managing TLS certificates via Certbot.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 11:22 AM
Security Audit — agent-trust-hub — sui-walrus