sui-security-guard
Use when setting up security scanning, detecting leaked secrets/API keys, implementing pre-commit hooks, or auditing a Sui Move contract for security/architecture/quality issues. Triggers on "security scan", "detect secrets", "pre-commit hook", "security audit setup", "API key leaked", and on contract-level review requests like "audit this contract", "review access control", "is this Move safe", "check for vulnerabilities", "Move security review" — these load the SEC/DES/PAT/TST/QA/CFG finding registry in references/move-security-findings.md. For offensive/adversarial testing (attack vector discovery, writing exploits/PoCs), use sui-red-team instead. For Move style/idiom quality (non-security), use move-code-quality.
Best use case
sui-security-guard is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Use when setting up security scanning, detecting leaked secrets/API keys, implementing pre-commit hooks, or auditing a Sui Move contract for security/architecture/quality issues. Triggers on "security scan", "detect secrets", "pre-commit hook", "security audit setup", "API key leaked", and on contract-level review requests like "audit this contract", "review access control", "is this Move safe", "check for vulnerabilities", "Move security review" — these load the SEC/DES/PAT/TST/QA/CFG finding registry in references/move-security-findings.md. For offensive/adversarial testing (attack vector discovery, writing exploits/PoCs), use sui-red-team instead. For Move style/idiom quality (non-security), use move-code-quality.
Teams using sui-security-guard should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/sui-security-guard/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How sui-security-guard Compares
| Feature / Agent | sui-security-guard | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Use when setting up security scanning, detecting leaked secrets/API keys, implementing pre-commit hooks, or auditing a Sui Move contract for security/architecture/quality issues. Triggers on "security scan", "detect secrets", "pre-commit hook", "security audit setup", "API key leaked", and on contract-level review requests like "audit this contract", "review access control", "is this Move safe", "check for vulnerabilities", "Move security review" — these load the SEC/DES/PAT/TST/QA/CFG finding registry in references/move-security-findings.md. For offensive/adversarial testing (attack vector discovery, writing exploits/PoCs), use sui-red-team instead. For Move style/idiom quality (non-security), use move-code-quality.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
Related Guides
SKILL.md Source
# SUI Security Guard
**Secret detection and pre-commit hooks for SUI projects.**
## Secret Detection
Scan the project for leaked secrets using grep patterns:
```bash
# SUI private keys
grep -rn 'suiprivkey1[a-zA-Z0-9]\{44\}' --include='*.ts' --include='*.move' --include='*.json' .
# Mnemonics (12+ word phrases that look like BIP39)
grep -rn '\b\(abandon\|ability\|able\|about\|above\)' --include='*.ts' --include='*.env' .
# API keys
grep -rn 'sk-[a-zA-Z0-9]\{20,\}\|sk-ant-[a-zA-Z0-9-]\{20,\}' .
# AWS credentials
grep -rn 'AKIA[A-Z0-9]\{16\}' .
# .env files that shouldn't be committed
git ls-files '*.env' '.env*'
```
If any matches are found: **rotate the key immediately**, then use `git-filter-repo` or `BFG Repo-Cleaner` to purge from git history.
## Pre-commit Hook Setup
Create `.git/hooks/pre-commit` to block secrets before they enter git:
```bash
#!/bin/sh
# Scan staged files for secrets before committing
STAGED=$(git diff --cached --name-only --diff-filter=ACM)
# Check for SUI private keys
if echo "$STAGED" | xargs grep -l 'suiprivkey1' 2>/dev/null; then
echo "❌ SUI private key detected in staged files. Commit blocked."
exit 1
fi
# Check for .env files
if echo "$STAGED" | grep -q '\.env$\|\.env\.'; then
echo "❌ .env file staged for commit. Add to .gitignore."
exit 1
fi
# Check for common API key patterns
if echo "$STAGED" | xargs grep -l 'sk-[a-zA-Z0-9]\{20,\}' 2>/dev/null; then
echo "❌ API key pattern detected. Commit blocked."
exit 1
fi
echo "✅ Security scan passed."
```
```bash
# Install the hook
chmod +x .git/hooks/pre-commit
```
For team-wide enforcement, use a shared hooks directory:
```bash
git config core.hooksPath .githooks/
# Then commit .githooks/pre-commit to the repo
```
## .gitignore Essentials
Ensure these are in `.gitignore`:
```
.env
.env.*
!.env.example
*.pem
*.key
```
## Security Checklist
Before deployment, verify:
- [ ] No hardcoded private keys or mnemonics in source
- [ ] `.env` files in `.gitignore`
- [ ] No API keys in frontend code (browser-accessible)
- [ ] AdminCap / UpgradeCap properly guarded (not public transfer)
- [ ] Pre-commit hook installed and active
## Move Contract Audit (deep review)
For a structured security/architecture review of Move source — beyond secret scanning —
use **[`references/move-security-findings.md`](references/move-security-findings.md)**: a 40-check
finding registry (SEC / DES / PAT / TST / QA / CFG) with S1–S4 severities and a 6-phase workflow,
distilled from MystenLabs' Move-code-review skill. Load it when the task is "audit this contract",
"review access control", "is this Move safe", or any contract-level security analysis. Supports
scoped reviews — report only the requested ID prefixes.
## Integration
- **Called by:** `sui-full-stack` (throughout development)
- For deep Move-contract auditing, use `references/move-security-findings.md` (above)
- For offensive/adversarial testing (attack vectors, exploits), use `sui-red-team`
- For code quality / Move style best practices, use `move-code-quality`Related Skills
sui-zklogin
Use when implementing zkLogin on SUI — OAuth login (Google, Facebook, Apple, Twitch) with zero-knowledge proofs for privacy-preserving authentication. Triggers on "zkLogin", "social login on SUI", "Google login", "OAuth", "ephemeral keypair", "JWT proof", or any authentication flow that derives a SUI address from an OAuth provider. Also use when the user mentions "login without wallet extension".
sui-walrus
Use when storing or retrieving files using Walrus — SUI's decentralized blob storage. Triggers on "Walrus", "blob storage", "upload file to chain", "decentralized storage", "store NFT image", "IPFS alternative on SUI", "where to store NFT metadata", "host a site on-chain", or any off-chain data storage needs on SUI. Also use for Walrus Sites (decentralized web hosting), storing game assets, media files, or when the user asks "where do I put large files on SUI".
sui-wallet
Use when performing on-chain transactions (transfer, Move call, publish) through the agent's CLI wallet via MCP tools. Triggers on "transfer SUI", "call Move function", "publish package", "wallet status", "sign transaction", or any agent-driven on-chain operation. This is for headless/backend wallet operations — for browser wallet UI (React/Vue), use sui-frontend instead.
sui-tester
Use when writing Move tests, setting up test suites, running gas benchmarks, or planning test strategy for SUI contracts. Triggers on "write tests", "test this module", "#[test]", "test coverage", "gas benchmark", "property-based test", or any Move testing task. Use even for simple "how do I test this function" questions.
sui-suins
Use when integrating SuiNS (SUI Name Service) — resolving .sui names to addresses, reverse lookups, or registering names. Triggers on "SuiNS", ".sui name", "name resolution", "reverse lookup", "human-readable address", or any name service integration. Also use when the user wants to display user-friendly names instead of hex addresses.
sui-seal
Use when implementing data encryption, access control, or secrets management on SUI using the Seal protocol. Triggers on threshold encryption, data privacy, token-gated content, encrypted storage, decryption policies, paywall, gated access, encrypted NFT metadata, private data sharing, or any scenario requiring on-chain access control for off-chain data. Also use when the user mentions Seal, pay-to-decrypt, "only NFT holders can see", or subscriber-only content on SUI.
sui-red-team
Use when performing adversarial security testing on SUI Move contracts — generating attack tests for access control bypass, integer overflow, object manipulation, economic exploits, reentrancy, and DoS vectors. Triggers on "red team", "attack test", "find vulnerabilities", "exploit", "pentest", "security test", or when the user wants to stress-test their contract's security. For defensive security setup (scanning, hooks, checklists), use sui-security-guard instead.
sui-passkey
Use when implementing WebAuthn passkeys or biometric authentication (Face ID, fingerprint, hardware keys) on SUI. Triggers on "passkey", "WebAuthn", "biometric login", "Face ID", "fingerprint auth", "FIDO2", or passwordless auth that uses device authenticators instead of seed phrases. Different from zkLogin (which uses OAuth providers).
sui-nautilus
Use when building verifiable off-chain computation, integrating external APIs with on-chain proof, or running trusted execution environments on SUI. Triggers on Nautilus, off-chain oracle, "verify API data on-chain", "connect external API to Move", "prove off-chain result", trusted compute, AWS Nitro Enclave, attestation, price feed, weather data on-chain, or any scenario requiring cryptographically verified external data. Also use when the user asks "how do I get real-world data into my SUI contract" or needs an oracle-like pattern.
sui-kiosk
Use when building NFT marketplaces, enforcing royalties, or managing transfer policies using SUI's Kiosk standard. Triggers on "Kiosk", "NFT marketplace", "transfer policy", "royalty enforcement", "list NFT for sale", "purchase rules", or any NFT commerce on SUI. Also use when the user asks about listing, delisting, or trading NFTs with enforced rules.
sui-install
Use when installing or updating the Sui CLI, managing CLI versions with suiup, or resolving environment/setup problems — "install sui", "update sui", "command not found", "sui not found", "client/server api version mismatch", build errors about "old dependencies", switching CLI versions per network, or installing toolchain components (Walrus, MVR, Move Analyzer, site-builder). Also use for first-time client setup, getting faucet tokens, recovering keys from a phrase, or "Cannot find gas coin for signer address". For deploying/upgrading packages use sui-deployer; for on-chain data queries use sui-ts-sdk.
sui-indexer
Use when building custom indexers, data pipelines, or event processors for the SUI blockchain. Triggers on "indexer", "data pipeline", "backfill", "event processor", "index transactions", "analytics dashboard", "aggregate on-chain data", "historical query", "track all trades", or any custom data extraction from SUI chain history. Also use when the user needs to build dashboards from on-chain data, process historical transactions, or set up real-time event streams.