[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-sui-walrus-data-security":3,"mdc-azfvqk-key":37,"related-org-sui-walrus-data-security":1304,"related-repo-sui-walrus-data-security":1479},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":28,"repoUrl":29,"updatedAt":30,"license":31,"forks":28,"topics":32,"repo":33,"sourceUrl":35,"mdContent":36},"walrus-data-security","encrypt and store data on Walrus","Encrypting data before storing on Walrus using Seal (threshold encryption with onchain access control). Use when the user needs to store private or sensitive data on Walrus, implement access control for blob content, encrypt blobs before uploading, use @mysten\u002Fseal for threshold encryption, or understand Walrus data security guarantees (availability, integrity, confidentiality). Also use when the user asks about Nautilus (TEE-based off-chain computation) in the context of Walrus data. All blobs on Walrus are public by default.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"sui","Sui (Mysten Labs)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fsui.png","MystenLabs",[13,17,19,22,25],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":8,"type":16},"Sui",{"name":20,"slug":21,"type":16},"Encryption","encryption",{"name":23,"slug":24,"type":16},"Access Control","access-control",{"name":26,"slug":27,"type":16},"Storage","storage",1,"https:\u002F\u002Fgithub.com\u002FMystenLabs\u002Fwalrus-skills","2026-07-16T06:01:48.700594",null,[],{"repoUrl":29,"stars":28,"forks":28,"topics":34,"description":31},[],"https:\u002F\u002Fgithub.com\u002FMystenLabs\u002Fwalrus-skills\u002Ftree\u002FHEAD\u002Fwalrus-data-security","---\nname: walrus-data-security\ndescription: >\n  Encrypting data before storing on Walrus using Seal (threshold encryption with\n  onchain access control). Use when the user needs to store private or sensitive data\n  on Walrus, implement access control for blob content, encrypt blobs before uploading,\n  use @mysten\u002Fseal for threshold encryption, or understand Walrus data security\n  guarantees (availability, integrity, confidentiality). Also use when the user asks\n  about Nautilus (TEE-based off-chain computation) in the context of Walrus data.\n  All blobs on Walrus are public by default.\n---\n\n# Walrus Data Security\n\n> **Source constraint:** All information in this skill is sourced from the\n> [Walrus data security documentation](https:\u002F\u002Fdocs.wal.app\u002Fdocs\u002Fdata-security)\n> and the [Seal SDK documentation](https:\u002F\u002Fseal-docs.wal.app\u002F).\n> When extending this skill, only pull from these sources.\n\nAll data stored on Walrus is public and discoverable by anyone. Blob IDs are not secrets. If your use case requires data confidentiality or access control, you must encrypt data before uploading. Seal is the recommended encryption solution for onchain access control with Walrus.\n\nAll patterns in this skill are derived from:\n- https:\u002F\u002Fdocs.wal.app\u002Fdocs\u002Fdata-security\n- https:\u002F\u002Fseal-docs.wal.app\u002F\n- https:\u002F\u002Fwww.npmjs.com\u002Fpackage\u002F@mysten\u002Fseal\n\nIf unsure about Seal or Walrus security, fetch the relevant page before answering.\n\n---\n\n## Related skills\n\n| Topic | Skill | Load when |\n|-------|-------|-----------|\n| Storing blobs | `walrus-cli` or `walrus-ts-sdk` | Uploading blobs (after encryption) |\n| HTTP API | `walrus-http-api` | Storing encrypted data via REST |\n| Blob lifecycle | `walrus-blob-lifecycle` | Managing encrypted blob lifetimes |\n| Move integration | `walrus-move-integration` | Onchain access policies for Seal |\n| Troubleshooting | `walrus-troubleshooting` | Seal error messages and fixes |\n\n---\n\n## Reference files\n\n### seal-sdk — Seal SDK Integration Guide\n**Path:** `seal-sdk.md`\n**Load when:** integrating the `@mysten\u002Fseal` TypeScript SDK, writing `seal_approve` Move functions, configuring key server object IDs, implementing encryption\u002Fdecryption flows, or debugging Seal-specific errors (session signing, sender mismatch, threshold not met).\n**Covers:** SealClient initialization, key server IDs, encryption\u002Fdecryption flow, `seal_approve` Move function pattern, access control patterns (allowlist, token gate, time lock), session signing, common errors table, limitations.\n\n---\n\n## Routing guide\n\n| Task | Load |\n|------|------|\n| Understand Walrus security guarantees | Skill Content below |\n| Encrypt data before storing on Walrus | `seal-sdk.md` |\n| Write a Seal access policy in Move | `seal-sdk.md` |\n| Debug Seal encryption\u002Fdecryption errors | `seal-sdk.md` |\n| Set up Nautilus TEE computation | Skill Content below |\n| Decide whether to use Seal or custom encryption | Skill Content below |\n\n---\n\n## Skill Content\n\n### Key concepts\n\n- **All Walrus blobs are public.** Anyone with a blob ID can fetch the blob. There is no native encryption or access control in Walrus itself. Blob IDs are not secrets.\n\n- **Encrypt before uploading.** To store private data, encrypt it client-side before calling any Walrus store operation. Walrus stores the ciphertext. Only parties with decryption keys can read the plaintext.\n\n- **Seal.** A threshold encryption system where no single party holds the full decryption key. You define onchain access policies (Move smart contracts) that determine who can decrypt and under what conditions. Seal integrates directly with Walrus and the Sui blockchain.\n\n- **Nautilus.** A framework for secure off-chain computation using trusted execution environments (TEEs). Use Nautilus for hybrid apps that need private data processing, AI inference, or Web2 integration with onchain verification.\n\n### Data availability guarantees\n\n- **Write threshold:** Blobs can be written and remain available as long as 2\u002F3 of shards are operated by honest storage nodes.\n- **Read threshold:** After data is written, reads are possible even if only 1\u002F3 of nodes are available.\n- **Point of availability (PoA):** Observable through a Sui event. Before PoA, you are responsible for blob availability. After PoA, Walrus maintains it for the full storage period.\n- **Inconsistency proofs:** If a blob is incorrectly encoded, storage nodes produce an inconsistency proof and reads return `None`. Correctly stored blobs cannot have false inconsistency proofs.\n\n### Data integrity\n\nWalrus guarantees that data read matches what the uploader intended. Because encoding is client-side, it is possible for encoding to be incorrect (by mistake or on purpose). The consistency check mechanisms (default and strict) detect and handle this.\n\n### Seal: Threshold encryption with onchain access control\n\nSeal provides:\n- **Threshold encryption:** No single party holds the full decryption key.\n- **Onchain access policies:** Move smart contracts define who can decrypt and under what conditions.\n- **Seamless Walrus integration:** Encrypt locally, store ciphertext on Walrus, define access rules on Sui.\n\n#### Use cases for Seal\n\n- Sensitive off-chain content: user documents, game assets, private messages\n- Time-locked or token-gated data\n- Data shared between trusted parties or roles\n\n#### Installation\n\n```bash\nnpm install @mysten\u002Fseal\n```\n\n#### Seal SDK initialization\n\n```typescript\nimport { SealClient } from '@mysten\u002Fseal';\nimport { SuiClient } from '@mysten\u002Fsui\u002Fclient';\n\nconst suiClient = new SuiClient({ url: getFullnodeUrl('mainnet') });\nconst sealClient = new SealClient({ suiClient, network: 'mainnet' });\n```\n\n#### Important: Set the transaction sender\n\nWhen building a programmable transaction block (PTB) for Seal policy checks, set the transaction sender before passing the PTB to Seal. The sender must match the address requesting decryption access:\n\n```typescript\ntx.setSender(address);\n```\n\nIf the sender is missing or does not match, decryption fails with `Transaction was not signed by the correct sender`.\n\n#### Wallet session signing\n\nSeal decryption requires the wallet to sign multiple transactions. Some wallets support **session signing** to avoid repeated approval prompts. If the connected wallet does not support session signing, you get `Connected wallet does not support Seal session signing`. In that case, the user must approve each signature individually, or use a different wallet that supports sessions.\n\n### Nautilus: Secure off-chain computation\n\nNautilus enables delegating sensitive or resource-intensive tasks to a self-managed trusted execution environment (TEE) while preserving onchain trust through smart contract verification.\n\n- Currently supports self-managed AWS Nitro Enclave TEEs\n- Attestations are verified onchain using Move smart contracts\n- Use for: trusted oracles, AI agents, DePIN, fraud prevention, identity management\n\nTo get started: https:\u002F\u002Fdocs.sui.io\u002Fconcepts\u002Fcryptography\u002Fnautilus\u002Fusing-nautilus\n\n### Rules\n\n1. **Always encrypt sensitive data before uploading to Walrus.** There is no server-side encryption. All blobs are public.\n2. **Blob IDs are not secrets.** Anyone with a blob ID can fetch the blob content. Security comes from encryption, not obscurity.\n3. **Use Seal for onchain access control.** If you want decryption tied to blockchain state (token ownership, time locks, role membership), Seal is the recommended solution.\n4. **Set `tx.setSender(address)` before Seal PTBs.** Missing or mismatched sender causes decryption to fail.\n5. **Delete does not guarantee privacy.** Even after deletion, copies might exist in caches, past storage nodes, or user downloads. Encryption is the only reliable privacy mechanism.\n\n### Common mistakes\n\n- **Storing sensitive data unencrypted on Walrus.** All blobs are public. Without encryption, anyone can read them.\n- **Assuming blob IDs are secret.** They are deterministic, derived from content. If someone has the content, they can compute the blob ID. If they have the blob ID, they can fetch the content.\n- **Forgetting `tx.setSender()` in Seal transactions.** The sender must be set explicitly on the PTB before passing it to Seal. This is the most common Seal integration error.\n- **Relying on delete for privacy.** Deletion removes slivers from current\u002Ffuture storage nodes but does not affect caches, past nodes, or copies others have made. Encrypt first.\n- **Confusing Seal with Walrus-native encryption.** Walrus itself has no encryption feature. Seal is a separate system that works alongside Walrus.\n- **`Connected wallet does not support Seal session signing`.** Not all wallets support Seal's session signing protocol. Check wallet compatibility or implement manual per-signature approval.\n- **Using Seal for HIPAA\u002FPHI or government-classified data.** Seal is not designed for highly regulated data. Its threat model assumes threshold trust among key servers, which might not meet regulatory requirements.\n- **Not specifying Seal key server object IDs.** The Seal client needs the correct key server object IDs for the target network. These are different for testnet and mainnet. Check the [Seal documentation](https:\u002F\u002Fseal-docs.wal.app\u002F) for current values.\n",{"data":38,"body":39},{"name":4,"description":6},{"type":40,"children":41},"root",[42,50,86,91,96,126,131,135,142,294,297,303,310,363,366,372,479,482,488,494,537,543,594,600,605,611,616,649,656,674,680,713,719,998,1004,1009,1043,1055,1061,1081,1087,1092,1110,1121,1127,1189,1195,1298],{"type":43,"tag":44,"props":45,"children":46},"element","h1",{"id":4},[47],{"type":48,"value":49},"text","Walrus Data Security",{"type":43,"tag":51,"props":52,"children":53},"blockquote",{},[54],{"type":43,"tag":55,"props":56,"children":57},"p",{},[58,64,66,75,77,84],{"type":43,"tag":59,"props":60,"children":61},"strong",{},[62],{"type":48,"value":63},"Source constraint:",{"type":48,"value":65}," All information in this skill is sourced from the\n",{"type":43,"tag":67,"props":68,"children":72},"a",{"href":69,"rel":70},"https:\u002F\u002Fdocs.wal.app\u002Fdocs\u002Fdata-security",[71],"nofollow",[73],{"type":48,"value":74},"Walrus data security documentation",{"type":48,"value":76},"\nand the ",{"type":43,"tag":67,"props":78,"children":81},{"href":79,"rel":80},"https:\u002F\u002Fseal-docs.wal.app\u002F",[71],[82],{"type":48,"value":83},"Seal SDK documentation",{"type":48,"value":85},".\nWhen extending this skill, only pull from these sources.",{"type":43,"tag":55,"props":87,"children":88},{},[89],{"type":48,"value":90},"All data stored on Walrus is public and discoverable by anyone. Blob IDs are not secrets. If your use case requires data confidentiality or access control, you must encrypt data before uploading. Seal is the recommended encryption solution for onchain access control with Walrus.",{"type":43,"tag":55,"props":92,"children":93},{},[94],{"type":48,"value":95},"All patterns in this skill are derived from:",{"type":43,"tag":97,"props":98,"children":99},"ul",{},[100,109,117],{"type":43,"tag":101,"props":102,"children":103},"li",{},[104],{"type":43,"tag":67,"props":105,"children":107},{"href":69,"rel":106},[71],[108],{"type":48,"value":69},{"type":43,"tag":101,"props":110,"children":111},{},[112],{"type":43,"tag":67,"props":113,"children":115},{"href":79,"rel":114},[71],[116],{"type":48,"value":79},{"type":43,"tag":101,"props":118,"children":119},{},[120],{"type":43,"tag":67,"props":121,"children":124},{"href":122,"rel":123},"https:\u002F\u002Fwww.npmjs.com\u002Fpackage\u002F@mysten\u002Fseal",[71],[125],{"type":48,"value":122},{"type":43,"tag":55,"props":127,"children":128},{},[129],{"type":48,"value":130},"If unsure about Seal or Walrus security, fetch the relevant page before answering.",{"type":43,"tag":132,"props":133,"children":134},"hr",{},[],{"type":43,"tag":136,"props":137,"children":139},"h2",{"id":138},"related-skills",[140],{"type":48,"value":141},"Related skills",{"type":43,"tag":143,"props":144,"children":145},"table",{},[146,170],{"type":43,"tag":147,"props":148,"children":149},"thead",{},[150],{"type":43,"tag":151,"props":152,"children":153},"tr",{},[154,160,165],{"type":43,"tag":155,"props":156,"children":157},"th",{},[158],{"type":48,"value":159},"Topic",{"type":43,"tag":155,"props":161,"children":162},{},[163],{"type":48,"value":164},"Skill",{"type":43,"tag":155,"props":166,"children":167},{},[168],{"type":48,"value":169},"Load when",{"type":43,"tag":171,"props":172,"children":173},"tbody",{},[174,206,228,250,272],{"type":43,"tag":151,"props":175,"children":176},{},[177,183,201],{"type":43,"tag":178,"props":179,"children":180},"td",{},[181],{"type":48,"value":182},"Storing blobs",{"type":43,"tag":178,"props":184,"children":185},{},[186,193,195],{"type":43,"tag":187,"props":188,"children":190},"code",{"className":189},[],[191],{"type":48,"value":192},"walrus-cli",{"type":48,"value":194}," or ",{"type":43,"tag":187,"props":196,"children":198},{"className":197},[],[199],{"type":48,"value":200},"walrus-ts-sdk",{"type":43,"tag":178,"props":202,"children":203},{},[204],{"type":48,"value":205},"Uploading blobs (after encryption)",{"type":43,"tag":151,"props":207,"children":208},{},[209,214,223],{"type":43,"tag":178,"props":210,"children":211},{},[212],{"type":48,"value":213},"HTTP API",{"type":43,"tag":178,"props":215,"children":216},{},[217],{"type":43,"tag":187,"props":218,"children":220},{"className":219},[],[221],{"type":48,"value":222},"walrus-http-api",{"type":43,"tag":178,"props":224,"children":225},{},[226],{"type":48,"value":227},"Storing encrypted data via REST",{"type":43,"tag":151,"props":229,"children":230},{},[231,236,245],{"type":43,"tag":178,"props":232,"children":233},{},[234],{"type":48,"value":235},"Blob lifecycle",{"type":43,"tag":178,"props":237,"children":238},{},[239],{"type":43,"tag":187,"props":240,"children":242},{"className":241},[],[243],{"type":48,"value":244},"walrus-blob-lifecycle",{"type":43,"tag":178,"props":246,"children":247},{},[248],{"type":48,"value":249},"Managing encrypted blob lifetimes",{"type":43,"tag":151,"props":251,"children":252},{},[253,258,267],{"type":43,"tag":178,"props":254,"children":255},{},[256],{"type":48,"value":257},"Move integration",{"type":43,"tag":178,"props":259,"children":260},{},[261],{"type":43,"tag":187,"props":262,"children":264},{"className":263},[],[265],{"type":48,"value":266},"walrus-move-integration",{"type":43,"tag":178,"props":268,"children":269},{},[270],{"type":48,"value":271},"Onchain access policies for Seal",{"type":43,"tag":151,"props":273,"children":274},{},[275,280,289],{"type":43,"tag":178,"props":276,"children":277},{},[278],{"type":48,"value":279},"Troubleshooting",{"type":43,"tag":178,"props":281,"children":282},{},[283],{"type":43,"tag":187,"props":284,"children":286},{"className":285},[],[287],{"type":48,"value":288},"walrus-troubleshooting",{"type":43,"tag":178,"props":290,"children":291},{},[292],{"type":48,"value":293},"Seal error messages and fixes",{"type":43,"tag":132,"props":295,"children":296},{},[],{"type":43,"tag":136,"props":298,"children":300},{"id":299},"reference-files",[301],{"type":48,"value":302},"Reference files",{"type":43,"tag":304,"props":305,"children":307},"h3",{"id":306},"seal-sdk-seal-sdk-integration-guide",[308],{"type":48,"value":309},"seal-sdk — Seal SDK Integration Guide",{"type":43,"tag":55,"props":311,"children":312},{},[313,318,320,326,331,333,339,341,347,349,354,356,361],{"type":43,"tag":59,"props":314,"children":315},{},[316],{"type":48,"value":317},"Path:",{"type":48,"value":319}," ",{"type":43,"tag":187,"props":321,"children":323},{"className":322},[],[324],{"type":48,"value":325},"seal-sdk.md",{"type":43,"tag":59,"props":327,"children":328},{},[329],{"type":48,"value":330},"Load when:",{"type":48,"value":332}," integrating the ",{"type":43,"tag":187,"props":334,"children":336},{"className":335},[],[337],{"type":48,"value":338},"@mysten\u002Fseal",{"type":48,"value":340}," TypeScript SDK, writing ",{"type":43,"tag":187,"props":342,"children":344},{"className":343},[],[345],{"type":48,"value":346},"seal_approve",{"type":48,"value":348}," Move functions, configuring key server object IDs, implementing encryption\u002Fdecryption flows, or debugging Seal-specific errors (session signing, sender mismatch, threshold not met).\n",{"type":43,"tag":59,"props":350,"children":351},{},[352],{"type":48,"value":353},"Covers:",{"type":48,"value":355}," SealClient initialization, key server IDs, encryption\u002Fdecryption flow, ",{"type":43,"tag":187,"props":357,"children":359},{"className":358},[],[360],{"type":48,"value":346},{"type":48,"value":362}," Move function pattern, access control patterns (allowlist, token gate, time lock), session signing, common errors table, limitations.",{"type":43,"tag":132,"props":364,"children":365},{},[],{"type":43,"tag":136,"props":367,"children":369},{"id":368},"routing-guide",[370],{"type":48,"value":371},"Routing guide",{"type":43,"tag":143,"props":373,"children":374},{},[375,391],{"type":43,"tag":147,"props":376,"children":377},{},[378],{"type":43,"tag":151,"props":379,"children":380},{},[381,386],{"type":43,"tag":155,"props":382,"children":383},{},[384],{"type":48,"value":385},"Task",{"type":43,"tag":155,"props":387,"children":388},{},[389],{"type":48,"value":390},"Load",{"type":43,"tag":171,"props":392,"children":393},{},[394,407,423,439,455,467],{"type":43,"tag":151,"props":395,"children":396},{},[397,402],{"type":43,"tag":178,"props":398,"children":399},{},[400],{"type":48,"value":401},"Understand Walrus security guarantees",{"type":43,"tag":178,"props":403,"children":404},{},[405],{"type":48,"value":406},"Skill Content below",{"type":43,"tag":151,"props":408,"children":409},{},[410,415],{"type":43,"tag":178,"props":411,"children":412},{},[413],{"type":48,"value":414},"Encrypt data before storing on Walrus",{"type":43,"tag":178,"props":416,"children":417},{},[418],{"type":43,"tag":187,"props":419,"children":421},{"className":420},[],[422],{"type":48,"value":325},{"type":43,"tag":151,"props":424,"children":425},{},[426,431],{"type":43,"tag":178,"props":427,"children":428},{},[429],{"type":48,"value":430},"Write a Seal access policy in Move",{"type":43,"tag":178,"props":432,"children":433},{},[434],{"type":43,"tag":187,"props":435,"children":437},{"className":436},[],[438],{"type":48,"value":325},{"type":43,"tag":151,"props":440,"children":441},{},[442,447],{"type":43,"tag":178,"props":443,"children":444},{},[445],{"type":48,"value":446},"Debug Seal encryption\u002Fdecryption errors",{"type":43,"tag":178,"props":448,"children":449},{},[450],{"type":43,"tag":187,"props":451,"children":453},{"className":452},[],[454],{"type":48,"value":325},{"type":43,"tag":151,"props":456,"children":457},{},[458,463],{"type":43,"tag":178,"props":459,"children":460},{},[461],{"type":48,"value":462},"Set up Nautilus TEE computation",{"type":43,"tag":178,"props":464,"children":465},{},[466],{"type":48,"value":406},{"type":43,"tag":151,"props":468,"children":469},{},[470,475],{"type":43,"tag":178,"props":471,"children":472},{},[473],{"type":48,"value":474},"Decide whether to use Seal or custom encryption",{"type":43,"tag":178,"props":476,"children":477},{},[478],{"type":48,"value":406},{"type":43,"tag":132,"props":480,"children":481},{},[],{"type":43,"tag":136,"props":483,"children":485},{"id":484},"skill-content",[486],{"type":48,"value":487},"Skill Content",{"type":43,"tag":304,"props":489,"children":491},{"id":490},"key-concepts",[492],{"type":48,"value":493},"Key concepts",{"type":43,"tag":97,"props":495,"children":496},{},[497,507,517,527],{"type":43,"tag":101,"props":498,"children":499},{},[500,505],{"type":43,"tag":59,"props":501,"children":502},{},[503],{"type":48,"value":504},"All Walrus blobs are public.",{"type":48,"value":506}," Anyone with a blob ID can fetch the blob. There is no native encryption or access control in Walrus itself. Blob IDs are not secrets.",{"type":43,"tag":101,"props":508,"children":509},{},[510,515],{"type":43,"tag":59,"props":511,"children":512},{},[513],{"type":48,"value":514},"Encrypt before uploading.",{"type":48,"value":516}," To store private data, encrypt it client-side before calling any Walrus store operation. Walrus stores the ciphertext. Only parties with decryption keys can read the plaintext.",{"type":43,"tag":101,"props":518,"children":519},{},[520,525],{"type":43,"tag":59,"props":521,"children":522},{},[523],{"type":48,"value":524},"Seal.",{"type":48,"value":526}," A threshold encryption system where no single party holds the full decryption key. You define onchain access policies (Move smart contracts) that determine who can decrypt and under what conditions. Seal integrates directly with Walrus and the Sui blockchain.",{"type":43,"tag":101,"props":528,"children":529},{},[530,535],{"type":43,"tag":59,"props":531,"children":532},{},[533],{"type":48,"value":534},"Nautilus.",{"type":48,"value":536}," A framework for secure off-chain computation using trusted execution environments (TEEs). Use Nautilus for hybrid apps that need private data processing, AI inference, or Web2 integration with onchain verification.",{"type":43,"tag":304,"props":538,"children":540},{"id":539},"data-availability-guarantees",[541],{"type":48,"value":542},"Data availability guarantees",{"type":43,"tag":97,"props":544,"children":545},{},[546,556,566,576],{"type":43,"tag":101,"props":547,"children":548},{},[549,554],{"type":43,"tag":59,"props":550,"children":551},{},[552],{"type":48,"value":553},"Write threshold:",{"type":48,"value":555}," Blobs can be written and remain available as long as 2\u002F3 of shards are operated by honest storage nodes.",{"type":43,"tag":101,"props":557,"children":558},{},[559,564],{"type":43,"tag":59,"props":560,"children":561},{},[562],{"type":48,"value":563},"Read threshold:",{"type":48,"value":565}," After data is written, reads are possible even if only 1\u002F3 of nodes are available.",{"type":43,"tag":101,"props":567,"children":568},{},[569,574],{"type":43,"tag":59,"props":570,"children":571},{},[572],{"type":48,"value":573},"Point of availability (PoA):",{"type":48,"value":575}," Observable through a Sui event. Before PoA, you are responsible for blob availability. After PoA, Walrus maintains it for the full storage period.",{"type":43,"tag":101,"props":577,"children":578},{},[579,584,586,592],{"type":43,"tag":59,"props":580,"children":581},{},[582],{"type":48,"value":583},"Inconsistency proofs:",{"type":48,"value":585}," If a blob is incorrectly encoded, storage nodes produce an inconsistency proof and reads return ",{"type":43,"tag":187,"props":587,"children":589},{"className":588},[],[590],{"type":48,"value":591},"None",{"type":48,"value":593},". Correctly stored blobs cannot have false inconsistency proofs.",{"type":43,"tag":304,"props":595,"children":597},{"id":596},"data-integrity",[598],{"type":48,"value":599},"Data integrity",{"type":43,"tag":55,"props":601,"children":602},{},[603],{"type":48,"value":604},"Walrus guarantees that data read matches what the uploader intended. Because encoding is client-side, it is possible for encoding to be incorrect (by mistake or on purpose). The consistency check mechanisms (default and strict) detect and handle this.",{"type":43,"tag":304,"props":606,"children":608},{"id":607},"seal-threshold-encryption-with-onchain-access-control",[609],{"type":48,"value":610},"Seal: Threshold encryption with onchain access control",{"type":43,"tag":55,"props":612,"children":613},{},[614],{"type":48,"value":615},"Seal provides:",{"type":43,"tag":97,"props":617,"children":618},{},[619,629,639],{"type":43,"tag":101,"props":620,"children":621},{},[622,627],{"type":43,"tag":59,"props":623,"children":624},{},[625],{"type":48,"value":626},"Threshold encryption:",{"type":48,"value":628}," No single party holds the full decryption key.",{"type":43,"tag":101,"props":630,"children":631},{},[632,637],{"type":43,"tag":59,"props":633,"children":634},{},[635],{"type":48,"value":636},"Onchain access policies:",{"type":48,"value":638}," Move smart contracts define who can decrypt and under what conditions.",{"type":43,"tag":101,"props":640,"children":641},{},[642,647],{"type":43,"tag":59,"props":643,"children":644},{},[645],{"type":48,"value":646},"Seamless Walrus integration:",{"type":48,"value":648}," Encrypt locally, store ciphertext on Walrus, define access rules on Sui.",{"type":43,"tag":650,"props":651,"children":653},"h4",{"id":652},"use-cases-for-seal",[654],{"type":48,"value":655},"Use cases for Seal",{"type":43,"tag":97,"props":657,"children":658},{},[659,664,669],{"type":43,"tag":101,"props":660,"children":661},{},[662],{"type":48,"value":663},"Sensitive off-chain content: user documents, game assets, private messages",{"type":43,"tag":101,"props":665,"children":666},{},[667],{"type":48,"value":668},"Time-locked or token-gated data",{"type":43,"tag":101,"props":670,"children":671},{},[672],{"type":48,"value":673},"Data shared between trusted parties or roles",{"type":43,"tag":650,"props":675,"children":677},{"id":676},"installation",[678],{"type":48,"value":679},"Installation",{"type":43,"tag":681,"props":682,"children":687},"pre",{"className":683,"code":684,"language":685,"meta":686,"style":686},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","npm install @mysten\u002Fseal\n","bash","",[688],{"type":43,"tag":187,"props":689,"children":690},{"__ignoreMap":686},[691],{"type":43,"tag":692,"props":693,"children":695},"span",{"class":694,"line":28},"line",[696,702,708],{"type":43,"tag":692,"props":697,"children":699},{"style":698},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[700],{"type":48,"value":701},"npm",{"type":43,"tag":692,"props":703,"children":705},{"style":704},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[706],{"type":48,"value":707}," install",{"type":43,"tag":692,"props":709,"children":710},{"style":704},[711],{"type":48,"value":712}," @mysten\u002Fseal\n",{"type":43,"tag":650,"props":714,"children":716},{"id":715},"seal-sdk-initialization",[717],{"type":48,"value":718},"Seal SDK initialization",{"type":43,"tag":681,"props":720,"children":724},{"className":721,"code":722,"language":723,"meta":686,"style":686},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import { SealClient } from '@mysten\u002Fseal';\nimport { SuiClient } from '@mysten\u002Fsui\u002Fclient';\n\nconst suiClient = new SuiClient({ url: getFullnodeUrl('mainnet') });\nconst sealClient = new SealClient({ suiClient, network: 'mainnet' });\n","typescript",[725],{"type":43,"tag":187,"props":726,"children":727},{"__ignoreMap":686},[728,778,820,830,922],{"type":43,"tag":692,"props":729,"children":730},{"class":694,"line":28},[731,737,743,749,754,759,764,768,773],{"type":43,"tag":692,"props":732,"children":734},{"style":733},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[735],{"type":48,"value":736},"import",{"type":43,"tag":692,"props":738,"children":740},{"style":739},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[741],{"type":48,"value":742}," {",{"type":43,"tag":692,"props":744,"children":746},{"style":745},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[747],{"type":48,"value":748}," SealClient",{"type":43,"tag":692,"props":750,"children":751},{"style":739},[752],{"type":48,"value":753}," }",{"type":43,"tag":692,"props":755,"children":756},{"style":733},[757],{"type":48,"value":758}," from",{"type":43,"tag":692,"props":760,"children":761},{"style":739},[762],{"type":48,"value":763}," '",{"type":43,"tag":692,"props":765,"children":766},{"style":704},[767],{"type":48,"value":338},{"type":43,"tag":692,"props":769,"children":770},{"style":739},[771],{"type":48,"value":772},"'",{"type":43,"tag":692,"props":774,"children":775},{"style":739},[776],{"type":48,"value":777},";\n",{"type":43,"tag":692,"props":779,"children":781},{"class":694,"line":780},2,[782,786,790,795,799,803,807,812,816],{"type":43,"tag":692,"props":783,"children":784},{"style":733},[785],{"type":48,"value":736},{"type":43,"tag":692,"props":787,"children":788},{"style":739},[789],{"type":48,"value":742},{"type":43,"tag":692,"props":791,"children":792},{"style":745},[793],{"type":48,"value":794}," SuiClient",{"type":43,"tag":692,"props":796,"children":797},{"style":739},[798],{"type":48,"value":753},{"type":43,"tag":692,"props":800,"children":801},{"style":733},[802],{"type":48,"value":758},{"type":43,"tag":692,"props":804,"children":805},{"style":739},[806],{"type":48,"value":763},{"type":43,"tag":692,"props":808,"children":809},{"style":704},[810],{"type":48,"value":811},"@mysten\u002Fsui\u002Fclient",{"type":43,"tag":692,"props":813,"children":814},{"style":739},[815],{"type":48,"value":772},{"type":43,"tag":692,"props":817,"children":818},{"style":739},[819],{"type":48,"value":777},{"type":43,"tag":692,"props":821,"children":823},{"class":694,"line":822},3,[824],{"type":43,"tag":692,"props":825,"children":827},{"emptyLinePlaceholder":826},true,[828],{"type":48,"value":829},"\n",{"type":43,"tag":692,"props":831,"children":833},{"class":694,"line":832},4,[834,840,845,850,855,860,865,870,876,881,886,890,894,899,903,908,913,918],{"type":43,"tag":692,"props":835,"children":837},{"style":836},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[838],{"type":48,"value":839},"const",{"type":43,"tag":692,"props":841,"children":842},{"style":745},[843],{"type":48,"value":844}," suiClient ",{"type":43,"tag":692,"props":846,"children":847},{"style":739},[848],{"type":48,"value":849},"=",{"type":43,"tag":692,"props":851,"children":852},{"style":739},[853],{"type":48,"value":854}," new",{"type":43,"tag":692,"props":856,"children":858},{"style":857},"--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF",[859],{"type":48,"value":794},{"type":43,"tag":692,"props":861,"children":862},{"style":745},[863],{"type":48,"value":864},"(",{"type":43,"tag":692,"props":866,"children":867},{"style":739},[868],{"type":48,"value":869},"{",{"type":43,"tag":692,"props":871,"children":873},{"style":872},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[874],{"type":48,"value":875}," url",{"type":43,"tag":692,"props":877,"children":878},{"style":739},[879],{"type":48,"value":880},":",{"type":43,"tag":692,"props":882,"children":883},{"style":857},[884],{"type":48,"value":885}," getFullnodeUrl",{"type":43,"tag":692,"props":887,"children":888},{"style":745},[889],{"type":48,"value":864},{"type":43,"tag":692,"props":891,"children":892},{"style":739},[893],{"type":48,"value":772},{"type":43,"tag":692,"props":895,"children":896},{"style":704},[897],{"type":48,"value":898},"mainnet",{"type":43,"tag":692,"props":900,"children":901},{"style":739},[902],{"type":48,"value":772},{"type":43,"tag":692,"props":904,"children":905},{"style":745},[906],{"type":48,"value":907},") ",{"type":43,"tag":692,"props":909,"children":910},{"style":739},[911],{"type":48,"value":912},"}",{"type":43,"tag":692,"props":914,"children":915},{"style":745},[916],{"type":48,"value":917},")",{"type":43,"tag":692,"props":919,"children":920},{"style":739},[921],{"type":48,"value":777},{"type":43,"tag":692,"props":923,"children":925},{"class":694,"line":924},5,[926,930,935,939,943,947,951,955,960,965,970,974,978,982,986,990,994],{"type":43,"tag":692,"props":927,"children":928},{"style":836},[929],{"type":48,"value":839},{"type":43,"tag":692,"props":931,"children":932},{"style":745},[933],{"type":48,"value":934}," sealClient ",{"type":43,"tag":692,"props":936,"children":937},{"style":739},[938],{"type":48,"value":849},{"type":43,"tag":692,"props":940,"children":941},{"style":739},[942],{"type":48,"value":854},{"type":43,"tag":692,"props":944,"children":945},{"style":857},[946],{"type":48,"value":748},{"type":43,"tag":692,"props":948,"children":949},{"style":745},[950],{"type":48,"value":864},{"type":43,"tag":692,"props":952,"children":953},{"style":739},[954],{"type":48,"value":869},{"type":43,"tag":692,"props":956,"children":957},{"style":745},[958],{"type":48,"value":959}," suiClient",{"type":43,"tag":692,"props":961,"children":962},{"style":739},[963],{"type":48,"value":964},",",{"type":43,"tag":692,"props":966,"children":967},{"style":872},[968],{"type":48,"value":969}," network",{"type":43,"tag":692,"props":971,"children":972},{"style":739},[973],{"type":48,"value":880},{"type":43,"tag":692,"props":975,"children":976},{"style":739},[977],{"type":48,"value":763},{"type":43,"tag":692,"props":979,"children":980},{"style":704},[981],{"type":48,"value":898},{"type":43,"tag":692,"props":983,"children":984},{"style":739},[985],{"type":48,"value":772},{"type":43,"tag":692,"props":987,"children":988},{"style":739},[989],{"type":48,"value":753},{"type":43,"tag":692,"props":991,"children":992},{"style":745},[993],{"type":48,"value":917},{"type":43,"tag":692,"props":995,"children":996},{"style":739},[997],{"type":48,"value":777},{"type":43,"tag":650,"props":999,"children":1001},{"id":1000},"important-set-the-transaction-sender",[1002],{"type":48,"value":1003},"Important: Set the transaction sender",{"type":43,"tag":55,"props":1005,"children":1006},{},[1007],{"type":48,"value":1008},"When building a programmable transaction block (PTB) for Seal policy checks, set the transaction sender before passing the PTB to Seal. The sender must match the address requesting decryption access:",{"type":43,"tag":681,"props":1010,"children":1012},{"className":721,"code":1011,"language":723,"meta":686,"style":686},"tx.setSender(address);\n",[1013],{"type":43,"tag":187,"props":1014,"children":1015},{"__ignoreMap":686},[1016],{"type":43,"tag":692,"props":1017,"children":1018},{"class":694,"line":28},[1019,1024,1029,1034,1039],{"type":43,"tag":692,"props":1020,"children":1021},{"style":745},[1022],{"type":48,"value":1023},"tx",{"type":43,"tag":692,"props":1025,"children":1026},{"style":739},[1027],{"type":48,"value":1028},".",{"type":43,"tag":692,"props":1030,"children":1031},{"style":857},[1032],{"type":48,"value":1033},"setSender",{"type":43,"tag":692,"props":1035,"children":1036},{"style":745},[1037],{"type":48,"value":1038},"(address)",{"type":43,"tag":692,"props":1040,"children":1041},{"style":739},[1042],{"type":48,"value":777},{"type":43,"tag":55,"props":1044,"children":1045},{},[1046,1048,1054],{"type":48,"value":1047},"If the sender is missing or does not match, decryption fails with ",{"type":43,"tag":187,"props":1049,"children":1051},{"className":1050},[],[1052],{"type":48,"value":1053},"Transaction was not signed by the correct sender",{"type":48,"value":1028},{"type":43,"tag":650,"props":1056,"children":1058},{"id":1057},"wallet-session-signing",[1059],{"type":48,"value":1060},"Wallet session signing",{"type":43,"tag":55,"props":1062,"children":1063},{},[1064,1066,1071,1073,1079],{"type":48,"value":1065},"Seal decryption requires the wallet to sign multiple transactions. Some wallets support ",{"type":43,"tag":59,"props":1067,"children":1068},{},[1069],{"type":48,"value":1070},"session signing",{"type":48,"value":1072}," to avoid repeated approval prompts. If the connected wallet does not support session signing, you get ",{"type":43,"tag":187,"props":1074,"children":1076},{"className":1075},[],[1077],{"type":48,"value":1078},"Connected wallet does not support Seal session signing",{"type":48,"value":1080},". In that case, the user must approve each signature individually, or use a different wallet that supports sessions.",{"type":43,"tag":304,"props":1082,"children":1084},{"id":1083},"nautilus-secure-off-chain-computation",[1085],{"type":48,"value":1086},"Nautilus: Secure off-chain computation",{"type":43,"tag":55,"props":1088,"children":1089},{},[1090],{"type":48,"value":1091},"Nautilus enables delegating sensitive or resource-intensive tasks to a self-managed trusted execution environment (TEE) while preserving onchain trust through smart contract verification.",{"type":43,"tag":97,"props":1093,"children":1094},{},[1095,1100,1105],{"type":43,"tag":101,"props":1096,"children":1097},{},[1098],{"type":48,"value":1099},"Currently supports self-managed AWS Nitro Enclave TEEs",{"type":43,"tag":101,"props":1101,"children":1102},{},[1103],{"type":48,"value":1104},"Attestations are verified onchain using Move smart contracts",{"type":43,"tag":101,"props":1106,"children":1107},{},[1108],{"type":48,"value":1109},"Use for: trusted oracles, AI agents, DePIN, fraud prevention, identity management",{"type":43,"tag":55,"props":1111,"children":1112},{},[1113,1115],{"type":48,"value":1114},"To get started: ",{"type":43,"tag":67,"props":1116,"children":1119},{"href":1117,"rel":1118},"https:\u002F\u002Fdocs.sui.io\u002Fconcepts\u002Fcryptography\u002Fnautilus\u002Fusing-nautilus",[71],[1120],{"type":48,"value":1117},{"type":43,"tag":304,"props":1122,"children":1124},{"id":1123},"rules",[1125],{"type":48,"value":1126},"Rules",{"type":43,"tag":1128,"props":1129,"children":1130},"ol",{},[1131,1141,1151,1161,1179],{"type":43,"tag":101,"props":1132,"children":1133},{},[1134,1139],{"type":43,"tag":59,"props":1135,"children":1136},{},[1137],{"type":48,"value":1138},"Always encrypt sensitive data before uploading to Walrus.",{"type":48,"value":1140}," There is no server-side encryption. All blobs are public.",{"type":43,"tag":101,"props":1142,"children":1143},{},[1144,1149],{"type":43,"tag":59,"props":1145,"children":1146},{},[1147],{"type":48,"value":1148},"Blob IDs are not secrets.",{"type":48,"value":1150}," Anyone with a blob ID can fetch the blob content. Security comes from encryption, not obscurity.",{"type":43,"tag":101,"props":1152,"children":1153},{},[1154,1159],{"type":43,"tag":59,"props":1155,"children":1156},{},[1157],{"type":48,"value":1158},"Use Seal for onchain access control.",{"type":48,"value":1160}," If you want decryption tied to blockchain state (token ownership, time locks, role membership), Seal is the recommended solution.",{"type":43,"tag":101,"props":1162,"children":1163},{},[1164,1177],{"type":43,"tag":59,"props":1165,"children":1166},{},[1167,1169,1175],{"type":48,"value":1168},"Set ",{"type":43,"tag":187,"props":1170,"children":1172},{"className":1171},[],[1173],{"type":48,"value":1174},"tx.setSender(address)",{"type":48,"value":1176}," before Seal PTBs.",{"type":48,"value":1178}," Missing or mismatched sender causes decryption to fail.",{"type":43,"tag":101,"props":1180,"children":1181},{},[1182,1187],{"type":43,"tag":59,"props":1183,"children":1184},{},[1185],{"type":48,"value":1186},"Delete does not guarantee privacy.",{"type":48,"value":1188}," Even after deletion, copies might exist in caches, past storage nodes, or user downloads. Encryption is the only reliable privacy mechanism.",{"type":43,"tag":304,"props":1190,"children":1192},{"id":1191},"common-mistakes",[1193],{"type":48,"value":1194},"Common mistakes",{"type":43,"tag":97,"props":1196,"children":1197},{},[1198,1208,1218,1236,1246,1256,1270,1280],{"type":43,"tag":101,"props":1199,"children":1200},{},[1201,1206],{"type":43,"tag":59,"props":1202,"children":1203},{},[1204],{"type":48,"value":1205},"Storing sensitive data unencrypted on Walrus.",{"type":48,"value":1207}," All blobs are public. Without encryption, anyone can read them.",{"type":43,"tag":101,"props":1209,"children":1210},{},[1211,1216],{"type":43,"tag":59,"props":1212,"children":1213},{},[1214],{"type":48,"value":1215},"Assuming blob IDs are secret.",{"type":48,"value":1217}," They are deterministic, derived from content. If someone has the content, they can compute the blob ID. If they have the blob ID, they can fetch the content.",{"type":43,"tag":101,"props":1219,"children":1220},{},[1221,1234],{"type":43,"tag":59,"props":1222,"children":1223},{},[1224,1226,1232],{"type":48,"value":1225},"Forgetting ",{"type":43,"tag":187,"props":1227,"children":1229},{"className":1228},[],[1230],{"type":48,"value":1231},"tx.setSender()",{"type":48,"value":1233}," in Seal transactions.",{"type":48,"value":1235}," The sender must be set explicitly on the PTB before passing it to Seal. This is the most common Seal integration error.",{"type":43,"tag":101,"props":1237,"children":1238},{},[1239,1244],{"type":43,"tag":59,"props":1240,"children":1241},{},[1242],{"type":48,"value":1243},"Relying on delete for privacy.",{"type":48,"value":1245}," Deletion removes slivers from current\u002Ffuture storage nodes but does not affect caches, past nodes, or copies others have made. Encrypt first.",{"type":43,"tag":101,"props":1247,"children":1248},{},[1249,1254],{"type":43,"tag":59,"props":1250,"children":1251},{},[1252],{"type":48,"value":1253},"Confusing Seal with Walrus-native encryption.",{"type":48,"value":1255}," Walrus itself has no encryption feature. Seal is a separate system that works alongside Walrus.",{"type":43,"tag":101,"props":1257,"children":1258},{},[1259,1268],{"type":43,"tag":59,"props":1260,"children":1261},{},[1262,1267],{"type":43,"tag":187,"props":1263,"children":1265},{"className":1264},[],[1266],{"type":48,"value":1078},{"type":48,"value":1028},{"type":48,"value":1269}," Not all wallets support Seal's session signing protocol. Check wallet compatibility or implement manual per-signature approval.",{"type":43,"tag":101,"props":1271,"children":1272},{},[1273,1278],{"type":43,"tag":59,"props":1274,"children":1275},{},[1276],{"type":48,"value":1277},"Using Seal for HIPAA\u002FPHI or government-classified data.",{"type":48,"value":1279}," Seal is not designed for highly regulated data. Its threat model assumes threshold trust among key servers, which might not meet regulatory requirements.",{"type":43,"tag":101,"props":1281,"children":1282},{},[1283,1288,1290,1296],{"type":43,"tag":59,"props":1284,"children":1285},{},[1286],{"type":48,"value":1287},"Not specifying Seal key server object IDs.",{"type":48,"value":1289}," The Seal client needs the correct key server object IDs for the target network. These are different for testnet and mainnet. Check the ",{"type":43,"tag":67,"props":1291,"children":1293},{"href":79,"rel":1292},[71],[1294],{"type":48,"value":1295},"Seal documentation",{"type":48,"value":1297}," for current values.",{"type":43,"tag":1299,"props":1300,"children":1301},"style",{},[1302],{"type":48,"value":1303},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1305,"total":1478},[1306,1322,1333,1343,1358,1376,1392,1405,1426,1438,1449,1465],{"slug":1307,"name":1307,"fn":1308,"description":1309,"org":1310,"tags":1311,"stars":1319,"repoUrl":1320,"updatedAt":1321},"move-bytecode-comprehension","analyze and disassemble Move bytecode","Use when reading or reasoning about compiled Move bytecode or `sui move disassemble` output. Mental model for the binary format, what survives compilation (and what's lost), and how to read disassembly soundly. Trigger on \"what does this package do?\", \"read this .mv module\", \"interpret this disassembly\", or whenever an analysis needs to interpret bytecode faithfully.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1312,1315,1318],{"name":1313,"slug":1314,"type":16},"Code Analysis","code-analysis",{"name":1316,"slug":1317,"type":16},"Engineering","engineering",{"name":18,"slug":8,"type":16},7724,"https:\u002F\u002Fgithub.com\u002FMystenLabs\u002Fsui","2026-07-16T05:59:32.904886",{"slug":1323,"name":1323,"fn":1324,"description":1325,"org":1326,"tags":1327,"stars":1319,"repoUrl":1320,"updatedAt":1332},"official-sui-skills","access official Sui development resources","Pointer to the official Mysten Labs skills for building on Sui — language fundamentals, object model, PTBs, SDKs, publishing, upgrades, frontend integration, accessing on-chain data. Maintained upstream at github.com\u002FMystenLabs\u002Fskills; pinned to the same ref the audit catalog derives from (see maintenance\u002FUPSTREAMS.md). Trigger on \"build a contract\", \"publish a package\", \"upgrade a module or package\", \"use the TypeScript SDK\", \"write a PTB\", \"set up a Sui client\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1328,1331],{"name":1329,"slug":1330,"type":16},"Documentation","documentation",{"name":18,"slug":8,"type":16},"2026-07-16T06:00:59.641382",{"slug":1334,"name":1334,"fn":1335,"description":1336,"org":1337,"tags":1338,"stars":1319,"repoUrl":1320,"updatedAt":1342},"sui-and-move-tools","disassemble Sui Move bytecode","Use to get bytecode for a deployed Sui package and produce a disassembled working view. One GraphQL call fetches every module's raw bytecode bytes; `sui move disassemble` (already on the system, running `sui prompt`) produces `.asm` files for analysis. Trigger on \"fetch this package's bytecode\", \"get me the .mv for package X\", \"disassemble this package\", or \"I need to read a deployed Sui package\".\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1339,1340,1341],{"name":1313,"slug":1314,"type":16},{"name":1316,"slug":1317,"type":16},{"name":18,"slug":8,"type":16},"2026-07-16T06:02:25.3633",{"slug":1344,"name":1344,"fn":1345,"description":1346,"org":1347,"tags":1348,"stars":1319,"repoUrl":1320,"updatedAt":1357},"sui-move-security-review","audit Sui Move smart contracts","Use when auditing, reviewing, or hunting for vulnerabilities in Move code on Sui. Applies equally to source code (.move files) and to disassembly of compiled bytecode (on-chain packages). A checklist of invariants whose VIOLATION causes exploitable bugs: access control & capabilities, struct abilities & type safety, object lifecycle & ownership, shared-object and PTB attack surface, dynamic fields & collections, arithmetic & coins, init\u002FOTW\u002Fpackage upgrades, hot-potato composability, time & on-chain randomness, and test-only code leakage. Trigger on \"audit this Move code\", \"find vulnerabilities in this Sui contract\", \"security review\", \"is this package safe?\", \"I suspect there's a bug in X\", \"something is wrong with this contract\", or when reasoning about whether a Move function can be abused.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1349,1352,1353,1356],{"name":1350,"slug":1351,"type":16},"Code Review","code-review",{"name":14,"slug":15,"type":16},{"name":1354,"slug":1355,"type":16},"Smart Contracts","smart-contracts",{"name":18,"slug":8,"type":16},"2026-07-16T06:02:55.691149",{"slug":1359,"name":1359,"fn":1360,"description":1361,"org":1362,"tags":1363,"stars":1373,"repoUrl":1374,"updatedAt":1375},"memwal","integrate Walrus Memory SDK","Walrus Memory SDK — portable agent memory that works across apps, sessions, and workflows.\n\nUse when users say:\n- \"add memory to my app\"\n- \"portable agent memory\"\n- \"integrate Walrus Memory\"\n- \"AI agent memory\"\n- \"memory across agents\"\n- \"Walrus memory storage\"\n- \"setup Walrus Memory\"\n- \"recall memories\"\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1364,1367,1370],{"name":1365,"slug":1366,"type":16},"Agents","agents",{"name":1368,"slug":1369,"type":16},"Memory","memory",{"name":1371,"slug":1372,"type":16},"SDK","sdk",57,"https:\u002F\u002Fgithub.com\u002FMystenLabs\u002FMemWal","2026-07-16T06:02:39.838395",{"slug":1377,"name":1377,"fn":1378,"description":1379,"org":1380,"tags":1381,"stars":1389,"repoUrl":1390,"updatedAt":1391},"accessing-data","read data from the Sui network","How to read data from the Sui network. Use when choosing or implementing a data access strategy — queries for on-chain state, indexing pipelines, historical lookups, event subscriptions, cross-chain reads, or off-chain blob storage. Covers the two live Sui APIs (gRPC and GraphQL RPC), the Archival Store, the General-Purpose Indexer, the `sui-indexer-alt` custom indexing framework, and Walrus for off-chain blobs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1382,1385,1386],{"name":1383,"slug":1384,"type":16},"Data Analysis","data-analysis",{"name":18,"slug":8,"type":16},{"name":1387,"slug":1388,"type":16},"Web3","web3",9,"https:\u002F\u002Fgithub.com\u002FMystenLabs\u002Fskills","2026-08-01T05:44:32.775598",{"slug":1393,"name":1393,"fn":1394,"description":1395,"org":1396,"tags":1397,"stars":1389,"repoUrl":1390,"updatedAt":1404},"composable-move-functions","design composable Sui Move functions","Use when writing Move functions on Sui, especially public APIs. Applies to function visibility (public vs entry), parameter ordering, and return patterns. Use whenever designing function signatures or deciding whether functions should transfer objects or return them.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1398,1401,1402,1403],{"name":1399,"slug":1400,"type":16},"API Development","api-development",{"name":1354,"slug":1355,"type":16},{"name":18,"slug":8,"type":16},{"name":1387,"slug":1388,"type":16},"2026-07-16T06:02:49.198495",{"slug":1406,"name":1406,"fn":1407,"description":1408,"org":1409,"tags":1410,"stars":1389,"repoUrl":1390,"updatedAt":1425},"frontend-apps","build Sui dApps with dapp-kit","Sui frontend \u002F dApp development with @mysten\u002Fdapp-kit-react (React) and @mysten\u002Fdapp-kit-core (Vue, vanilla JS, Svelte, Web Components, other frameworks). Use when building browser apps that connect Sui wallets, query on-chain state, or submit transactions. Covers wallet connection, network switching, transaction execution, query patterns with TanStack React Query, and the specific pitfalls of browser + wallet + async-indexer environments. Pair with the `sui-sdks` skill for @mysten\u002Fsui Transaction construction patterns and the `ptbs` skill for PTB semantics.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1411,1414,1417,1418,1421,1424],{"name":1412,"slug":1413,"type":16},"Frontend","frontend",{"name":1415,"slug":1416,"type":16},"React","react",{"name":18,"slug":8,"type":16},{"name":1419,"slug":1420,"type":16},"Svelte","svelte",{"name":1422,"slug":1423,"type":16},"Vue","vue",{"name":1387,"slug":1388,"type":16},"2026-08-01T05:44:28.958473",{"slug":1427,"name":1427,"fn":1428,"description":1429,"org":1430,"tags":1431,"stars":1389,"repoUrl":1390,"updatedAt":1437},"generate-sui-agent-config","generate configuration files for Sui projects","Generate a CLAUDE.md or AGENT.md configuration file for Sui projects. Use when setting up a new Sui project, when user mentions \"CLAUDE.md\", \"AGENT.md\", \"agent config\", or when working on a Sui project that does not already have a CLAUDE.md or AGENT.md in the project root.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1432,1435,1436],{"name":1433,"slug":1434,"type":16},"Configuration","configuration",{"name":1329,"slug":1330,"type":16},{"name":18,"slug":8,"type":16},"2026-07-16T06:00:59.981056",{"slug":1439,"name":1439,"fn":1440,"description":1441,"org":1442,"tags":1443,"stars":1389,"repoUrl":1390,"updatedAt":1448},"modern-move-syntax","write Move 2024 edition code for Sui","Use when writing Move code on Sui to ensure 2024 edition syntax is used. Applies to method calls, string literals, vector operations, option handling, loops, and struct unpacking. Use whenever writing Move code to avoid legacy function-call syntax patterns.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1444,1445,1446,1447],{"name":1316,"slug":1317,"type":16},{"name":1354,"slug":1355,"type":16},{"name":18,"slug":8,"type":16},{"name":1387,"slug":1388,"type":16},"2026-07-16T06:02:43.277596",{"slug":1450,"name":1450,"fn":1451,"description":1452,"org":1453,"tags":1454,"stars":1389,"repoUrl":1390,"updatedAt":1464},"move-unit-testing","write unit tests for Sui Move contracts","Use when writing unit tests for Move smart contracts on Sui. Applies to test function naming, assertions, test attributes, context usage, and cleanup patterns. Use whenever user asks to write tests, add tests, or test a Move module.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1455,1458,1459,1460,1463],{"name":1456,"slug":1457,"type":16},"QA","qa",{"name":1354,"slug":1355,"type":16},{"name":18,"slug":8,"type":16},{"name":1461,"slug":1462,"type":16},"Testing","testing",{"name":1387,"slug":1388,"type":16},"2026-08-01T05:44:30.788585",{"slug":1466,"name":1466,"fn":1467,"description":1468,"org":1469,"tags":1470,"stars":1389,"repoUrl":1390,"updatedAt":1477},"naming-conventions","apply Sui Move naming conventions","Use when writing or reviewing Move smart contracts on Sui. Applies to naming structs, error constants, regular constants, events, getter functions, capability types, hot potato types, and dynamic field keys. Use whenever creating new types, functions, or constants in Move code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1471,1474,1475,1476],{"name":1472,"slug":1473,"type":16},"Best Practices","best-practices",{"name":1354,"slug":1355,"type":16},{"name":18,"slug":8,"type":16},{"name":1387,"slug":1388,"type":16},"2026-07-16T06:02:48.830052",37,{"items":1480,"total":1551},[1481,1490,1501,1509,1521,1532,1541],{"slug":244,"name":244,"fn":1482,"description":1483,"org":1484,"tags":1485,"stars":28,"repoUrl":29,"updatedAt":1489},"manage Walrus blob lifecycles","Managing Walrus blob lifecycles: epochs, lifetimes, extending blobs, deleting blobs, burning blob objects, sharing blobs, setting blob attributes, and handling large uploads. Use when the user needs to extend a blob's lifetime, delete or burn blobs, create shared blobs, set\u002Fget\u002Fremove blob attributes, plan large data uploads (>1 GiB), estimate storage costs, manage concurrent upload memory, or understand epoch-based expiration. For basic store\u002Fread, see `walrus-cli`. For quilts, see `walrus-quilts`.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1486,1487,1488],{"name":26,"slug":27,"type":16},{"name":18,"slug":8,"type":16},{"name":1387,"slug":1388,"type":16},"2026-07-16T06:01:49.056917",{"slug":192,"name":192,"fn":1491,"description":1492,"org":1493,"tags":1494,"stars":28,"repoUrl":29,"updatedAt":1500},"manage Walrus blobs via CLI","Walrus CLI client for storing, reading, and managing blobs from the command line. Use when the user needs to run walrus store, walrus read, walrus blob-status, walrus extend, walrus delete, walrus share, or any other walrus CLI command. Also use for CLI installation, configuration (client_config.yaml), JSON mode for scripting, gas budgets, wallet configuration, and logging. For blob lifecycle management details, see `walrus-blob-lifecycle`. For quilts, see `walrus-quilts`.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1495,1498,1499],{"name":1496,"slug":1497,"type":16},"CLI","cli",{"name":26,"slug":27,"type":16},{"name":18,"slug":8,"type":16},"2026-07-16T06:02:52.586222",{"slug":4,"name":4,"fn":5,"description":6,"org":1502,"tags":1503,"stars":28,"repoUrl":29,"updatedAt":30},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1504,1505,1506,1507,1508],{"name":23,"slug":24,"type":16},{"name":20,"slug":21,"type":16},{"name":14,"slug":15,"type":16},{"name":26,"slug":27,"type":16},{"name":18,"slug":8,"type":16},{"slug":222,"name":222,"fn":1510,"description":1511,"org":1512,"tags":1513,"stars":28,"repoUrl":29,"updatedAt":1520},"store and read Walrus blobs via HTTP","Walrus publisher and aggregator REST API for storing and reading blobs over HTTP. Use when the user needs to store or read Walrus blobs using HTTP PUT\u002FGET requests, integrate Walrus from any programming language, configure storage options (epochs, deletable, permanent, send_object_to), or parse store\u002Fread API responses. Also use when troubleshooting HTTP API errors or CDN caching issues after upload. For quilt HTTP endpoints, see the `walrus-quilts` skill. For CLI usage, see `walrus-cli`.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1514,1517,1518,1519],{"name":1515,"slug":1516,"type":16},"REST API","rest-api",{"name":26,"slug":27,"type":16},{"name":18,"slug":8,"type":16},{"name":1387,"slug":1388,"type":16},"2026-07-16T06:01:48.340552",{"slug":1522,"name":1522,"fn":1523,"description":1524,"org":1525,"tags":1526,"stars":28,"repoUrl":29,"updatedAt":1531},"walrus-memory","integrate persistent memory with Walrus","Walrus Memory (MemWal) — persistent, portable, encrypted memory for AI agents. Use when the user needs to give an AI agent persistent memory across sessions and apps, integrate the @mysten-incubation\u002Fmemwal TypeScript SDK or Python memwal SDK, set up the Walrus Memory MCP server for Cursor\u002FClaude\u002FCodex, configure remember\u002Frecall\u002Fanalyze\u002Frestore operations, manage memory spaces and namespaces, set up delegate keys and accounts, self-host the relayer, or use withMemWal AI middleware (Vercel AI SDK, LangChain, OpenAI SDK). Also use when the user asks about MemWal, Walrus Memory, agent memory, memory spaces, or the memwal-mcp package.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1527,1528,1529,1530],{"name":1365,"slug":1366,"type":16},{"name":20,"slug":21,"type":16},{"name":1368,"slug":1369,"type":16},{"name":18,"slug":8,"type":16},"2026-07-29T05:39:21.825246",{"slug":266,"name":266,"fn":1533,"description":1534,"org":1535,"tags":1536,"stars":28,"repoUrl":29,"updatedAt":1540},"integrate Walrus blobs in Sui Move","Referencing and wrapping Walrus blobs in Sui Move smart contracts. Use when the user needs to wrap a Walrus Blob object in a custom Move struct, add Walrus as a Move dependency, build a contract that depends on the Walrus package, or integrate on-chain logic with Walrus blob storage. Also use when the user asks about wrapped_blob.move, the Walrus Move package, or how to reference blobs from Move code.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1537,1538,1539],{"name":1354,"slug":1355,"type":16},{"name":26,"slug":27,"type":16},{"name":18,"slug":8,"type":16},"2026-07-16T06:02:53.633159",{"slug":1542,"name":1542,"fn":1543,"description":1544,"org":1545,"tags":1546,"stars":28,"repoUrl":29,"updatedAt":1550},"walrus-overview","provide overview of Walrus storage","High-level overview of Walrus: what it is, how it works, and which tool to use. Use when the user is new to Walrus, asks \"what is Walrus\", \"how does Walrus work\", \"what is a blob\", or needs to choose between CLI, HTTP API, TypeScript SDK, and Move integration. Also use when explaining Walrus architecture, comparing Walrus to AWS S3 or IPFS, explaining the publisher\u002Faggregator\u002Fupload relay distinction, or clarifying blob ID vs Sui object ID. This is the entry-point skill for Walrus newcomers.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1547,1548,1549],{"name":1329,"slug":1330,"type":16},{"name":26,"slug":27,"type":16},{"name":18,"slug":8,"type":16},"2026-07-16T06:02:52.247749",11]