Sui Vibe

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:39 AM UTC
• Version: 1.0.1

Overview

WALVIS appears to be a real knowledge-manager skill, but its installer and runtime add persistent OpenClaw behavior and include unsafe sync, local API, and wallet-handling paths that users should review before installing.

Review this skill before installing. Do not sync sensitive vault contents to Walrus until encryption is fixed and explicitly verified. Use a test wallet with no valuable assets, avoid running the local dashboard on exposed networks, pin all npx/package versions, and remove the SOUL.md injection or require explicit opt-in with rollback before use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: bin/cli.js:426

Finding

Persistent workspace-wide agent identity and behavior injection

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: extensions/walvis-fastpath/index.js:1098

Finding

Fast-path synchronization bypasses configured Seal encryption

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: web/vite-plugin-local-api.js:49

Finding

Unauthenticated local vault API exposed with host validation disabled

Content

View full analysis

{ // Only handle /api/local/* routes if (!req.url.startsWith('/api/local/')) { return next(); } try { // GET /api/local/manifest if (req.url === '/api/local/manifest' && req.method === 'GET') { const manifest = JSON.parse(readFileSync(join(WALVIS_DIR, 'manifest.json'), 'utf-8')); res.setHeader('Content-Type', 'application/json'); res.end(JSON.stringify(manifest)); return; } // GET /api/local/spaces/:id const spaceMatch = req.url.match(/^\/api\/local\/spaces\/([^\/]+)$/); if (spaceMatch && req.method === 'GET') { const spaceId = spaceMatch[1]; const space = JSON.parse(readFileSync(join(WALVIS_DIR, 'spaces', `${spaceId}.json`), 'utf-8')); res.setHeader('Content-Type', 'application/json'); res.end(JSON.stringify(space)); return; } // DELETE /api/local/spaces/:spaceId/items/:itemId const deleteMatch = req.url.match(/^\/api\/local\/spaces\/([^\/]+)\/items\/([^\/]+)$/); if (deleteMatch && req.method === 'DELETE') { const [, spaceId, itemId] = deleteMatch; const spacePath = join(WALVIS_DIR, 'spaces', `${spaceId}.json`); const space = JSON.parse(readFileSync(spacePath, 'utf-8')); space.items = space.items.filter(i => i.id !== itemId); space.updatedAt = new Date().toISOString(); writeFileSync(spacePath, JSON.stringify(space, null, 2)); res.setHeader('Content-Type', 'application/json'); res.end(JSON.stringify({ success: true })); return; } ``` The Vite configuration disables host validation: ...[truncated 1618 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: extensions/walvis-fastpath/index.js:576

Finding

Security-sensitive commands dynamically download and execute unpinned packages

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: skill/scripts/seal-crypto.ts:59

Finding

Wallet operations automatically load and use the first private key in the Sui keystore

Content

View full analysis

{ const manifest = readManifest(); const packageId = resolveSealPackageId(manifest); if (!packageId) { throw new Error('sealPackageId not set. Deploy walvis_seal for this network and set manifest.sealPackageId.'); } const suiClient = getSuiClient(); const keypair = loadKeypair(); const tx = new Transaction(); tx.moveCall({ target: `${packageId}::${SEAL_MODULE}::create_and_share`, arguments: [ tx.pure.vector('u8', new TextEncoder().encode(spaceName)), ], }); const result = await suiClient.signAndExecuteTransaction({ transaction: tx, signer: keypair, options: { showObjectChanges: true }, }); ``` ### Technical Analysis The code directly reads secret key material from the Sui CLI keystore and unconditionally selects `keystore[0]`. It does not verify that this key corresponds to the wallet address configured in the WALVIS manifest, and it does not provide an explicit signer-selection step. The key is then used to sign and execute a blockchain transaction. Direct secret-key loading expands the Skill's access beyond a narrow wallet-signing interface and makes the private key available inside the same process that ...[truncated 1192 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: skill/scripts/walrus-sync.ts:51

Finding

Seal recovery key is stored as plaintext Base64 in ordinary vault data

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (107)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description presents WALVIS as an end-user knowledge manager for saving Telegram content and syncing to Walrus. The supplied code chunk does not implement that user-facing bookmark-management behavior; instead, it is an installer/bootstrapper. While some setup actions are supportive of the broader product, several important behaviors are not reflected in the description: scanning for local/Docker OpenClaw installations, inspecting Docker mounts, copying skill/plugin/hook files, editing OpenClaw configuration to enable components and Telegram inline buttons, persisting LLM credentials into config, and injecting text into SOUL.md. These are materially different operational capabilities from the declared storage/organization purpose, so this chunk is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description is only partially accurate. The code does implement a knowledge-manager workflow for saving URLs and text, organizing them with tags/notes, syncing to Walrus, and exposing web/local dashboard info. However, several material mismatches exist: (1) the advertised 'AI-powered' behavior is not present here—tagging and summarization are deterministic heuristics or webpage metadata scraping, not AI; (2) the code introduces substantial undeclared capabilities, including querying blockchain wallet balances, Seal-based encryption and access sharing, and running external scripts via npx/tsx; and (3) storage behavior differs from the description because the primary operational store is local files under ~/.walvis, with Walrus used during sync rather than as the sole store. Therefore the declared description does not accurately represent the full actual behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a user-facing AI knowledge manager centered on ingesting Telegram content, AI auto-tagging/organization, Walrus storage, and web browsing. The supplied code does not implement Telegram ingestion, AI tagging, image/text/link capture, or web UI behavior. Instead, it focuses on cryptographic access control and blockchain interactions: creating Seal policies on Sui testnet, encrypting/decrypting stored space data, signing transactions with a locally loaded keypair, and managing an allowlist through CLI commands. While encryption for Walrus-stored data could be a supporting feature of the overall product, this chunk introduces significant undeclared capabilities and a materially different primary function than the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about a knowledge management product for collecting Telegram content, tagging/organizing it with AI, storing it on Walrus, and browsing via a web UI. The supplied code does none of that. Instead, it implements a command-line wallet utility that reads local manifest data, connects to Sui testnet/mainnet RPC endpoints, checks token balances, and submits faucet requests. These are materially different capabilities and indicate an undeclared blockchain wallet-management function unrelated to the stated purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied code chunk is specifically a command-line search/query script for locally stored bookmark spaces. It reads JSON space files from a local directory, scores and searches item text, lists tags, filters by tag, and prints formatted results. This is related to a knowledge-management system, so it is not completely unrelated; however, the declared description emphasizes saving content from Telegram, AI auto-tagging/organization, Walrus decentralized storage, and web UI browsing. None of those core capabilities are implemented or evidenced in this chunk. Instead, the code’s primary purpose is local querying of existing data. Because the observed behavior materially differs from the declared end-user description for this skill chunk, this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 76% confidence

Finding

The instruction to 'Always respond — never leave the user without feedback' is an anti-refusal pattern that can pressure the agent to continue with unsafe or partially failed operations rather than stopping cleanly. In a skill that writes files, runs commands, and performs network actions, anti-refusal language raises the chance that safety checks are overridden in favor of completing tasks.

Content

Scanner excerpt · SKILL.md (reported line 680)May include surrounding context.

md

- If content analysis is unclear, save with a fallback title (URL or first 80 chars)
- If Walrus sync fails, keep data locally and tell user to retry
- If a space doesn't exist, create it automatically
- Always respond — never leave the user without feedback

## Cron Job Setup

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · extensions/walvis-fastpath/index.js (reported line 227)May include surrounding context.

js

function clearPending(ctx) {
  const state = readState();
  delete state.pending[buildParticipantKey(ctx)];
  writeState(state);
}

Known Vulnerable Dependency: path-to-regexp==8.2.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

path-to-regexp is used by transitive Vercel components, and the flagged 8.2.0 version has reported ReDoS/DoS issues. If attacker-controlled route patterns or crafted path input reaches these parsing paths during local tooling, preview, or deployment-related HTTP handling, it can trigger excessive backtracking and process resource exhaustion.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: path-to-regexp==6.1.0 — 1 advisory(ies): CVE-2024-45296 (path-to-regexp outputs backtracking regular expressions)

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The pinned path-to-regexp 6.1.0 version is associated with backtracking regular-expression generation, which can enable denial of service when processing crafted paths. In this project it appears under @vercel/node, so the risk is mainly through development, build, or hosted request-routing paths rather than core Telegram knowledge-management logic.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==5.28.4 — 14 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +11 more

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

undici 5.28.4 has multiple network-protocol advisories including request smuggling, response queue poisoning, and CRLF-related issues. Because this package is used in the Vercel runtime stack, exploitation could affect outbound or proxied HTTP handling, potentially leading to request confusion, header injection, or cross-request contamination under specific deployment conditions.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: basic-ftp==5.2.0 — 4 advisory(ies): GHSA-6v7q-wjvx-w8wg (basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Exe); CVE-2026-39983 (basic-ftp has FTP Command Injection via CRLF); CVE-2026-41324 (basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl) +1 more

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

basic-ftp is present through proxy/PAC-related transitive dependencies and carries command-injection and DoS advisories. If the application or its tooling resolves attacker-influenced proxy/PAC/FTP URLs, a crafted target could induce unsafe FTP command handling or resource exhaustion.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 86% confidence

Finding

brace-expansion 1.1.12 has several DoS-class issues involving pathological pattern expansion and memory consumption. In practice this matters when untrusted glob or brace patterns are accepted by tooling; here it is transitive, so the danger is mostly in development/build-time file matching rather than core app runtime.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 83% confidence

Finding

form-data 4.0.5 has a CRLF injection issue in multipart field names/filenames, which can enable malformed requests or header/body manipulation when untrusted values are serialized. Given this skill handles saved links, text, and images and depends on the Vercel stack, any future code path that uploads or forwards user content could make this more relevant.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==5.0.4 — 5 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-45149 (brace-expansion: Large numeric range defeats documented `max` DoS protection) +2 more

High

• Category: Supply Chain
• Confidence: 87% confidence

Finding

brace-expansion 5.0.4 is also flagged for multiple expansion-related DoS conditions. Even though this is a transitive dependency, any code path that processes attacker-controlled glob-like input could be forced into heavy CPU or memory consumption.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill encourages storing user content on decentralized storage but does not prominently warn about privacy, persistence, and potential public retrievability implications. Users may save sensitive Telegram content under the assumption it behaves like ordinary private app storage, causing irreversible data exposure.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 70% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · skill/SKILL.md (reported line 668)May include surrounding context.

md

- If content analysis is unclear, save with a fallback title (URL or first 80 chars)
- If Walrus sync fails, keep data locally and tell user to retry
- If a space doesn't exist, create it automatically
- Always respond — never leave the user without feedback

## Cron Job Setup

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The DELETE endpoint accepts attacker-controlled spaceId and itemId and immediately mutates local storage without any authorization or confirmation. Because this route is exposed by the local dev server, a malicious site or local process that can reach the server could delete WALVIS items from the user's local knowledge base, causing data loss and integrity compromise.

Content

Scanner excerpt · web/vite-plugin-local-api.js (reported line 155)May include surrounding context.

js

return;
          }

          // DELETE /api/local/spaces/:spaceId/items/:itemId
          const deleteMatch = req.url.match(/^\/api\/local\/spaces\/([^\/]+)\/items\/([^\/]+)$/);
          if (deleteMatch && req.method === 'DELETE') {
            const [, spaceId, itemId] = deleteMatch;

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The documentation instructs users to run npx walvis without pinning a specific package version. Because npx resolves and executes the latest published package by default, a compromised or maliciously updated package could be executed on the user's machine, creating a supply-chain risk. In the context of an agent skill installer, this is more dangerous because users may run the command with high trust and potentially broad local access.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx walvis without pinning a specific version, which means execution depends on whatever package version is current at install time. If the package is updated maliciously, compromised, or unexpectedly changed, users could execute unreviewed code during installation or setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README describes syncing spaces to Walrus, sharing blob IDs, and trying a public demo manifest, but it does not clearly warn that synced or shared vault contents may become publicly accessible on decentralized storage. In a knowledge-manager context that handles notes, links, images, and reminders, users may reasonably store sensitive personal or work data, so lack of explicit disclosure materially increases privacy and data-exposure risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The command npx @mysten/walrus-site-builder publish web/dist also executes the latest package by default, creating a supply-chain risk. Because this command is used for deployment, compromise could affect both the local environment and published site artifacts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The allowed tools and design enable persistent local storage, scheduled tasks, browser/network access, and messaging. Persistent capabilities are not inherently malicious, but in this context they materially increase risk because the skill can store data, act later via cron, and interact with remote services beyond a single transient request.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

description: W.A.L.V.I.S. - AI-powered knowledge manager. Save anything from Telegram — links, text, images. Auto-tag and organize with AI; store on Walrus decentralized storage; browse via web UI on wal.app.
version: 0.2.0
user-invocable: true
allowed-tools: Bash(node:*) Bash(npx:*) Bash(curl:*) Read Write Edit WebFetch browser cron message
metadata.openclaw: {"requires":{"anyBins":["node"]},"emoji":"🐋","homepage":"https://github.com/yourusername/walvis","install":[{"kind":"node","pkg":"walvis"}]}
---

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs the agent to execute npx walvis without pinning a version. That allows whatever package is latest at execution time to run, creating a supply-chain risk where a compromised or changed package can execute arbitrary code on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

A second unpinned npx walvis invocation repeats the same supply-chain problem: the agent may fetch and run unreviewed code from the registry at runtime. Because this is a setup/init path, it is especially likely to run on first use when trust is highest and scrutiny is lowest.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: bin/cli.js:241

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: extensions/walvis-fastpath/index.js:66

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/smoke-walvis-scripts.mjs:13

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: extensions/walvis-fastpath/index.js:565

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: skill/scripts/analyze.ts:77