sui-walrus

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's required workflows (see "3. HTTP API" and the SDK read methods in sections 4.1/4.6) instruct fetching blobs from public publishers/aggregators and upload-relays (public endpoints) and then reading/decoding those blobs (e.g., .text(), .json()), and since Walrus blobs are explicitly public and user-provided, that third-party content could influence tool behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes a CDN fallback that at runtime may fetch and execute remote WebAssembly from https://unpkg.com/@mysten/walrus-wasm@latest/web/walrus_wasm_bg.wasm, which is a runtime-fetched binary that executes code and is relied upon when the bundler cannot resolve the WASM, so it meets the criteria for a risky external dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill exposes explicit blockchain financial operations: SDK/CLI methods require a signer/keypair and perform on-chain Sui transactions (register, certify, writeBlob, extend, delete, burn), the upload-relay tip configuration includes explicit tip addresses and amounts, and the tooling documents a built-in swap command ("walrus get-wal" swaps SUI→WAL). These are concrete crypto/blockchain signing and token-transfer operations (wallet use, swaps, and tipping), which constitute Direct Financial Execution authority.