Sui security guard

Skill first-mover-tw/sui-dev-agents/skills/sui-security-guard

Use when setting up security scanning, detecting leaked secrets/API keys, implementing pre-commit hooks, or auditing a Sui Move contract for security/architecture/quality issues. Triggers on "security scan", "detect secrets", "pre-commit hook", "security audit setup", "API key leaked", and on contract-level review requests like "audit this contract", "review access control", "is this Move safe", "check for vulnerabilities", "Move security review" — these load the SEC/DES/PAT/TST/QA/CFG finding registry in references/move-security-findings.md. For offensive/adversarial testing (attack vector discovery, writing exploits/PoCs), use sui-red-team instead. For Move style/idiom quality (non-security), use move-code-quality.From its SKILL.md

Install

npx -y skills add first-mover-tw/sui-dev-agents --skill sui-security-guard

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

7 stars7 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.8 KB, as published. Nobody here has run it

SUI Security Guard

Secret detection and pre-commit hooks for SUI projects.

Secret Detection

Scan the project for leaked secrets using grep patterns:

# SUI private keys
grep -rn 'suiprivkey1[a-zA-Z0-9]\{44\}' --include='*.ts' --include='*.move' --include='*.json' .

# Mnemonics (12+ word phrases that look like BIP39)
grep -rn '\b\(abandon\|ability\|able\|about\|above\)' --include='*.ts' --include='*.env' .

# API keys
grep -rn 'sk-[a-zA-Z0-9]\{20,\}\|sk-ant-[a-zA-Z0-9-]\{20,\}' .

# AWS credentials
grep -rn 'AKIA[A-Z0-9]\{16\}' .

# .env files that shouldn't be committed
git ls-files '*.env' '.env*'

If any matches are found: rotate the key immediately, then use git-filter-repo or BFG Repo-Cleaner to purge from git history.

Pre-commit Hook Setup

Create .git/hooks/pre-commit to block secrets before they enter git:

#!/bin/sh
# Scan staged files for secrets before committing

STAGED=$(git diff --cached --name-only --diff-filter=ACM)

# Check for SUI private keys
if echo "$STAGED" | xargs grep -l 'suiprivkey1' 2>/dev/null; then
  echo "❌ SUI private key detected in staged files. Commit blocked."
  exit 1
fi

# Check for .env files
if echo "$STAGED" | grep -q '\.env$\|\.env\.'; then
  echo "❌ .env file staged for commit. Add to .gitignore."
  exit 1
fi

# Check for common API key patterns
if echo "$STAGED" | xargs grep -l 'sk-[a-zA-Z0-9]\{20,\}' 2>/dev/null; then
  echo "❌ API key pattern detected. Commit blocked."
  exit 1
fi

echo "✅ Security scan passed."

# Install the hook
chmod +x .git/hooks/pre-commit

For team-wide enforcement, use a shared hooks directory:

git config core.hooksPath .githooks/
# Then commit .githooks/pre-commit to the repo

.gitignore Essentials

Ensure these are in .gitignore:

.env
.env.*
!.env.example
*.pem
*.key

Security Checklist

Before deployment, verify:

No hardcoded private keys or mnemonics in source
.env files in .gitignore
No API keys in frontend code (browser-accessible)
AdminCap / UpgradeCap properly guarded (not public transfer)
Pre-commit hook installed and active

Move Contract Audit (deep review)

For a structured security/architecture review of Move source — beyond secret scanning — use references/move-security-findings.md: a 40-check finding registry (SEC / DES / PAT / TST / QA / CFG) with S1–S4 severities and a 6-phase workflow, distilled from MystenLabs' Move-code-review skill. Load it when the task is "audit this contract", "review access control", "is this Move safe", or any contract-level security analysis. Supports scoped reviews — report only the requested ID prefixes.

Integration

Called by: sui-full-stack (throughout development)
For deep Move-contract auditing, use references/move-security-findings.md (above)
For offensive/adversarial testing (attack vectors, exploits), use sui-red-team
For code quality / Move style best practices, use move-code-quality