sui-move-security-review

sui-move-security-review is a Smart contracts & Web3 skill for AI agents, published by MystenLabs in the sui repository on GitHub. Skillspace rates sui-move-security-review D (66/100) and it passed the safety scan; the rating is based on static analysis only.

Use when auditing, reviewing, or hunting for vulnerabilities in Move code on Sui. Applies equally to source code (.move files) and to disassembly of compiled bytecode (on-chain packages). A checklist of invariants whose VIOLATION causes exploitable bugs: access control & capabilities, struct abilities & type safety, object lifecycle & ownership, shared-object and PTB attack surface, dynamic fields & collections, arithmetic & coins, init/OTW/package upgrades, hot-potato composability, time & on-chain randomness, and test-only code leakage. Trigger on "audit this Move code", "find vulnerabilities in this Sui contract", "security review", "is this package safe?", "I suspect there's a bug in X", "something is wrong with this contract", or when reasoning about whether a Move function can be abused.

Grade
D
Quality
66 / 100
Safety
Passed
GitHub stars
7,726

Unproven: rated by static analysis only, not yet compared head-to-head.

Our two independent classifiers differ on this skill's category, so treat the placement as provisional.

This rating describes the version of the repository we crawled; it may have changed since, so go by its current files.

View source on GitHubMystenLabs/sui

Our review

Architecture
84 / 100
Maturity
Structured: ships references or scripts
Security scan
No issues found
License
Apache-2.0
Adoption
Adopted by 0 other repositories, in 0 collections
Scope
Vendor-specific: built around one product. Security review checklist for public Sui Move platform code

Not checked yet

  • Not judged on the rubric yet (not a contender in its category)
  • No blind task eval yet
  • Sibling files (scripts, references) not fetched; security scan covers SKILL.md only

Better-rated skills in Smart contracts & Web3

Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.