Security audit

Sui Sec

Security checks for vulnerabilities and agentic risk

Overview

This Sui transaction guardrail claims broad protection but only implements a narrow spending check, which could let unsafe transactions be labeled safe.

Review before installing or relying on this skill. It may be useful only as a limited dry-run helper, not as an authoritative transaction security gate. Do not let it automatically approve signing or execution without independent review of recipients, all asset movements, object ownership changes, call targets, and simulation output.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: main.py:52
Finding: Caller-Controlled Owner Address Bypasses Transaction Loss Detection
Content: View full analysis
' ") sys.exit(1) raw_cmd = sys.argv[1] intended_cost = float(sys.argv[2]) owner_addr = sys.argv[3] # 1. Execute secure simulation raw_output = run_simulation(raw_cmd) # 2. Parse JSON (filtering out potential ASCII warning text from Sui CLI) try: json_start = raw_output.find('{') if json_start == -1: raise ValueError("No JSON found") json_data = json.loads(raw_output[json_start:]) # 3. Perform the audit audit_balance_changes(json_data, intended_cost, owner_addr) ``` ### Technical Analysis The auditor calculates SUI loss only for the address supplied through the `owner_address` command-line argument. It does not derive the transaction sender from authoritative Sui simulation output or verify that the supplied address is the signer. This contradicts the documented claim in `SKILL.md` that the tool detects the sender from simulation output. If an unrelated address is supplied, none of the actual sender's negative balance changes match `owner_addr`. Consequently, `actual_sui_loss` remains zero and the transaction can receive a `SAFE TO SIGN` verdict. The issue is fail-open because the absence of matching balance records is interpreted as zero expenditure rather than an invalid or ambiguous sender. ### Attack Pa ...[truncated 988 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: main.py:61
Finding: Object Ownership Hijack Detection Is Unimplemented
Content: View full analysis
(intended_cost + 0.02): print(f"🚨 [RESULT] ❌ MALICIOUS: Price mismatch detected!") print(f" Hidden drain of {actual_sui_loss - intended_cost:.4f} SUI.") sys.exit(1) else: print(f"✅ [RESULT] SAFE TO SIGN.") ``` ### Technical Analysis The code creates a `hijacked_objects` list but never populates or evaluates it. The loop handling mutated objects contains only `pass`. Created, transferred, deleted, wrapped, published, and other object-change types are also not checked. The final decision depends exclusively on native SUI expenditure. Therefore, an unexpected ownership change involving an NFT, capability object, token object, profile, or other Sui object does not affect the verdict. This is particularly dangerous because `SKILL.md` represents object hijacking as an automatically detected threat and treats the script's exit code as authoritative. The discrepancy can lead downstream agents to trust a control that does not exist. ### Attack Path 1. An attacker constructs a PTB that transfers or otherwise diverts a user-owned object to an attacker-controlled address. 2. The transaction keeps native SUI expenditure within the accepted i ...[truncated 802 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: main.py:47
Finding: Non-SUI Asset Losses Are Excluded from Audit Decisions
Content: View full analysis
(intended_cost + 0.02): print(f"🚨 [RESULT] ❌ MALICIOUS: Price mismatch detected!") print(f" Hidden drain of {actual_sui_loss - intended_cost:.4f} SUI.") sys.exit(1) else: print(f"✅ [RESULT] SAFE TO SIGN.") ``` ### Technical Analysis The `coinType` condition restricts accounting to native SUI. Negative balance changes involving USDC, wrapped assets, LP tokens, protocol tokens, or any other coin type are ignored. The final verdict has no alternative validation path for these assets. A transaction can therefore remove a valuable non-SUI balance while spending only an acceptable amount of SUI for gas. The transaction will pass because the ignored asset loss does not contribute to `actual_sui_loss`. The auditor also does not compare recipients, expected outputs, minimum received amounts, or per-asset direction against user intent. ### Attack Path 1. The user's wallet contains a non-SUI coin, such as a stablecoin or protocol token. 2. An attacker prepares a PTB that transfers that asset to an attacker-controlled address. 3. Native SUI expenditure remains below the declared amount plus the hardcoded gas buffer. 4. The dry-run reports the non-SUI loss in `balanceChanges`. 5. The `coinType == "0x2::sui::SUI"` condition excludes the loss. 6. The native SUI comparison passes and the auditor emits `SAFE TO ...[truncated 403 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: main.py:84
Finding: Non-Finite Intended-Cost Values Bypass the Spending Threshold
Content: View full analysis
(intended_cost + 0.02): print(f"🚨 [RESULT] ❌ MALICIOUS: Price mismatch detected!") print(f" Hidden drain of {actual_sui_loss - intended_cost:.4f} SUI.") sys.exit(1) else: print(f"✅ [RESULT] SAFE TO SIGN.") ``` ```python raw_cmd = sys.argv[1] intended_cost = float(sys.argv[2]) owner_addr = sys.argv[3] ``` ### Technical Analysis Python's `float()` accepts special values such as `nan`, `inf`, and `Infinity`. The code does not verify that `intended_cost` is finite, non-negative, or within a reasonable range. When `intended_cost` is `nan`, the expression `actual_sui_loss > (nan + 0.02)` evaluates to false for ordinary numeric losses. Positive infinity similarly permits every finite loss. Because the `else` branch prints `SAFE TO SIGN`, these values bypass the only implemented spending threshold. Binary floating-point arithmetic is also inappropriate for authoritative financial limits because it can introduce precision errors, although the non-finite-value bypass is the direct security issue. ### Attack Path 1. An attacker supplies `nan` or `inf` as the intended-cost argument. 2. `float()` accepts the value without raising an exception. 3. The Sui transaction is simulated and may show a substantial native SUI loss. 4. The threshold calculation produces `nan` or positive infinity. 5. The greater-than comparison does not identify the loss as excessive. 6. The auditor executes the safe branch and prints `SAFE TO SIGN`. 7. A relying agent may proceed with the harmful transaction. ### Impact Assessment An attacker who controls or influences the intended-cost argument can completely bypass the native SUI spending limit. The resulting on-chain impact can ...[truncated 125 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: main.py:14
Finding: Executable Check Does Not Restrict Commands to Sui PTB Simulations
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill presents itself as a security gatekeeper that broadly compares transaction behavior against user intent and blocks malicious actions, but the described implementation is materially narrower and incomplete. Overstating detection coverage is dangerous because users may rely on the skill to approve transactions it is not actually capable of validating, creating a false sense of security around potentially malicious smart-contract behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill presents itself as a security gatekeeper that broadly compares transaction behavior against user intent and blocks malicious actions, but the described implementation is materially narrower and incomplete. Overstating detection coverage is dangerous because users may rely on the skill to approve transactions it is not actually capable of validating, creating a false sense of security around potentially malicious smart-contract behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill promises to pre-simulate transactions, compare results against user intent, and block malicious contract behavior, but the implementation only checks aggregate SUI loss against an intended cost threshold. It does not meaningfully verify object transfers, package calls, recipient addresses, token movements, capability transfers, or other side effects, so a malicious transaction could still steal assets or perform unintended actions while being labeled 'SAFE TO SIGN.'
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill invokes shell-capable commands (python3, sui client ...) but does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where an agent runtime may expose broader shell access than users or platform policy expect, increasing the risk of unintended command execution or abuse if prompt content is manipulated.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · main.py (reported line 30)May include surrounding context.
python
args.append('--json') # Core security fix: Execute using a list and disable shell result = subprocess.run( args, capture_output=True, text=True,

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code and comments state that object ownership hijacking is detected, but the relevant loop contains only a placeholder 'pass' and performs no protection. In a security tool whose core purpose is to stop malicious contract behavior, this creates a dangerous false sense of safety: users may trust a 'SAFE TO SIGN' result even when simulated effects transfer NFTs, objects, or capabilities away from the owner.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.