Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    movescan

    1

    Static bug-pattern scanner for Move smart contracts on Aptos and Sui targeting resource safety and access control.

    $5

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    movescan

    movescan

    Example session with this skill installed

    Scan the ./contracts/liquidity_pool directory for any high-severity Move vulnerabilities.

    • Read your context and instructions
    • Compiled the movescan

    I have completed the static analysis of the /contracts/liquidity_pool directory using MoveScan. The scanner identified 3 findings, including one high-severity issue related to resource abilities.

    Move Security Scan Results

    SeverityDetectorFileLineFinding
    HIGHability-misusepool.move42Struct LPToken has copy and drop abilities.
    MEDIUMdiv-before-mulmath.move118Precision loss in calculate_reward: (amount / total_shares) * reward_rate.
    LOWcast-truncationvault.move89Narrowing cast from u128 to u64 in get_balance.

    Critical Finding: Ability Misuse

    In pool.move, the LPToken struct represents a claim on pool liquidity but is declared with both copy and drop. This allows an attacker or a buggy function to duplicate their shares or accidentally delete them, leading to a total loss of funds or infinite minting.

    Recommendation: Remove copy and drop from LPToken. It should only have store and key to ensure it behaves as a strictly regulated resource.

    Next steps

    • Remove the copy and drop abilities from the LPToken struct definition in pool.move.
    • Refactor math.move to perform multiplication before division to maintain decimal precision.
    • Implement a move test to verify that LPToken can no longer be duplicated using the copy keyword.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Move smart contracts bypass many Solidity-style vulnerabilities, but introduce unique risks around resource abilities and capability management. A manual review of a large Aptos or Sui repository is slow and error-prone. This skill automates the initial triage phase by scanning Move source code for specific, high-impact bug patterns.

    What it does

    • Detects ability misuse by flagging value-bearing structs like Coin or Balance that incorrectly implement copy or drop abilities.
    • Identifies access control gaps in public or entry functions that modify global state without proper signer verification.
    • Spots capability leaks where administrative capabilities are returned from public functions without authorization guards.
    • Flags precision loss by locating division-before-multiplication patterns in sensitive financial math like fee or interest calculations.
    • Catches truncation risks in narrowing integer casts (e.g., as u64) that could lead to silent data loss.

    How it works

    1. Run the movescan.scanner module against a specific Move project directory or individual .move file.
    2. Use the --min-severity flag to filter the noise and focus on high-risk vulnerabilities first.
    3. Review the generated list of files and line numbers to pinpoint specific logic flaws in the source.
    4. Verify findings manually against the code context to filter out false positives before reporting.

    Frameworks & tools

    This tool is built for Move smart contracts on the Aptos and Sui blockchains. It is a pure-Python static analyzer with no external dependencies, requiring only Python 3.9 or higher.

    Why this beats prompting it yourself

    Generic LLM prompts often miss Move-specific nuances like resource safety and struct abilities, leading to generic advice. This skill uses targeted pattern matching designed specifically for the Move VM, ensuring it catches structural flaws that general-purpose security prompts overlook.

    Use cases

    • Auditing a new Aptos or Sui repository before a mainnet deployment.
    • Identifying high-value targets in a codebase for bug bounty hunting.
    • Integrating a fast security check into a local development workflow.
    • Performing a first-pass triage on complex Move packages to guide manual review.

    Known limitations

    This is a pattern-based static analyzer, not a formal verifier or symbolic execution engine. It lacks cross-file resolution and a full type-checker, which may result in false positives.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scanned

    Verified clean 15 days ago

    • Passed all security checks, Safe to install

    Requires

    Python

    Listed15 days ago

    What's inside

    Frequently Asked Questions