Move Auditor
Audits Move contracts (Sui & Aptos) for security bugs.
Install
npx skills add pantheraudits/move-auditor --skill move-auditorgit clone --depth 1 https://github.com/pantheraudits/move-auditor.git /tmp/move-auditor
mkdir -p ~/.claude/skills
cp -r /tmp/move-auditor/. ~/.claude/skills/move-auditorPersonal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.
From the SKILL.md
# Move Auditor > Fast, systematic security feedback on Move smart contracts (Sui & Aptos). > Activates automatically on `.move` files — no setup, no copy-pasting. --- ## Activation This skill activates whenever: - `.move` files are detected in the working directory or opened in the editor - The user asks to audit, review, check security, or find vulnerabilities in Move code - Keywords like `module`, `struct`, `entry fun`, `public fun`, `sui::`, `aptos_framework::` appear in scope When activated, immediately begin **Phase 1** without waiting for instructions. ## When NOT to Use - Non-Move contracts (Solidity, Rust/Anchor, EVM, TEAL, FunC) - General code review for style, performance, or refactoring - Writing Move code, generating patches, or fixing bugs - When user explicitly requests a quick scan without full verification --- ## Reference Files All reference files are in the **same directory as this SKILL.md**. When the instructions below say "read `filename.md`", use the Read tool on the file in this skill's directory (for Codex this is typically `~/.codex/skills/move-auditor/`; for Claude Code this is typically `~/.claude/commands/move-auditor/`). | File | When to load | |------|-------------| | `common-move.md` | **Always** — chain-agnostic checks (sections 1–13), verification checklist | | `verification-policy.md` | **Always** — evidence hierarchy, mock rejection rule, feasibility gates, severity discipline |
Details
- Skill name
move-auditor- Repository
- pantheraudits/move-auditor
- Repo updated
- 19 August 2026
FAQ
What does the Move Auditor skill do?
Audits Move contracts (Sui & Aptos) for security bugs.
How do I install the Move Auditor skill?
skills CLI (Claude Code, Cursor, Codex and more): npx skills add pantheraudits/move-auditor --skill move-auditor. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.
Is Move Auditor popular?
It lives in pantheraudits/move-auditor, which has 20 GitHub stars and 8 forks.
Related skills
Security Research
22rhysha/claude-security-research-skill
Full-spectrum security research skill for web servers, REST APIs, web applications, and network/port enumeration. Triggers whenever the user wants to: find vulnerabilities, run a security assessment, scan a target, test an API for security issues, enumerate ports or services, check for OWASP Top 10 vulnerabilities, audit auth/secrets, fuzz endpoints, run recon on a domain or IP, or use tools like nmap, nikto, nuclei, ZAP, sqlmap, ffuf, dalfox, subfinder, hydra, or trufflehog. Use this skill even if the user says "just a quick scan" or phrases it casually. Covers full engagement workflow: recon
Slopsec
25lachydotmcg/slopsec
Security audit and hardening for vibe-coded SaaS apps. Use when reviewing, securing, hardening, or pen-testing an app — especially AI-generated / vibe-coded / "shipped fast" projects (Next.js, Supabase, Firebase, Express, serverless). Triggers: "is my app secure", "security review", "harden this", "check for vulnerabilities", "I'm about to launch", "audit before deploy", "exposed secrets", "leaked API keys", "before I ship". Walks the 50 most common ways vibe-coded apps get owned and produces a prioritized fix list.
Security Scan
20Ray0907/security-scan
Use when a user asks to scan a repository for dependency vulnerabilities, license compliance, insecure code patterns, CVEs, or OWASP Top 10 risks.
Pentest Tool
27Jumbo-WJB/pentest-skills
Autonomous penetration testing framework. Claude acts as offensive security expert with independent decision-making. Provides methodology and principles, not command scripts. ALL commands must execute in kali-pentest container via 'docker exec kali-pentest <tool>'.
Malware Analysis Static
12guelfoweb/malware-analysis-static
Use this skill for static malware analysis and reverse engineering of suspicious binaries, Android APKs, Office documents, web payloads, scripts, source-code droppers, and multi-stage chains across Linux, macOS, and Windows. It guides Codex through safe lab workflow, tool discovery with per-install authorization, triage, staged payload retrieval when authorized, decoding, evidence preservation, AGENTS.md memory, REPORT.md reporting, C2/drop URL extraction, and family attribution.
Prism Scanner
28aidongise-cell/prism-scanner
Security scanner for AI Agent skills, plugins, and MCP servers. Use when: user asks to scan a skill, check if a plugin is safe, vet an MCP server, review skill security, detect malicious code, supply chain safety, or says 'is this safe to install', 'scan this skill', 'check this MCP server', 'security scan', 'vetting', 'skill safety', 'prism scan', '安全扫描', '这个插件安全吗', '扫描一下', '检查安全性', '安装前检查', '技能审查'.
Browse the most popular Claude skills, all security skills, or write your own with the skills generator.