I Built an Open-Source Move Auditor Skill for Claude Code

3,000+ lines of vulnerability patterns for Sui & Aptos — plugged directly into your AI workflow.

2 weeks ago I open-sourced my generic audit prompts and workflow. Those were chain-agnostic — they worked for Solidity, Rust, Move, whatever. The feedback was great, but one thing kept nagging me: generic prompts produce generic results.

When I started doing more Move audits — both Sui and Aptos — I realized the attack surface is fundamentally different from EVM. Object ownership models, capability patterns, hot potatoes, witness abuse, PTB reentrancy, acquires annotations, resource account escalation. None of this exists in Solidity. My generic prompts weren't catching these.

So I built something specific.

---

1. What is move-auditor?

It's a Claude Code skill — not a standalone tool, not a CLI binary. You install it once, and it turns Claude Code into a Move-specialized security auditor. It auto-activates when you open .move files.

That's it. No config files, no API keys, no setup beyond a cp.

---

2. Why a Skill Instead of Just Better Prompts?

My previous repo was a collection of prompts you copy-paste into your workflow. It worked. But there were problems:

• Context fragmentation — you'd paste one prompt, get results, paste another, lose context from the first pass
• No structured workflow — the order you run checks matters. Access control before DeFi vectors, codebase mapping before vulnerability scanning
• Generic coverage — a prompt that says "check for reentrancy" doesn't know that Sui reentrancy looks nothing like EVM reentrancy

A Claude Code skill solves all three. It's a structured, multi-phase audit workflow that loads chain-specific patterns on demand and produces a consistent report format every time.

---

3. The 5-Phase Audit Workflow

The skill doesn't just dump a checklist. It runs a structured 5-phase process:

Phase 2 is the one I think matters most. Asking the AI to think from three perspectives — attacker, designer, integrator — catches things a single-pass review misses. An attacker thinks about what they can call. A designer thinks about what invariants should hold. An integrator thinks about what happens when this module composes with others.

---

4. What It Actually Checks

The skill ships with 3,000+ lines of security checks across four reference files. Here's the breakdown:

Common Move Checks (chain-agnostic)

These apply to all Move code — Sui, Aptos, or any future Move chain:

• Access control — missing capability gates, copy-ability on caps, hardcoded admin addresses
• Arithmetic — overflow DoS, division-before-multiplication, cast truncation
• Resource safety — leaks, unauthorized extraction, double-spend via phantom resources
• Logic invariants — state machine violations, timestamp manipulation
• Cross-module safety — reentrancy, unvalidated return values, stale state after external calls
• Upgradeability — single-key authority, reinitialization, missing emergency pause

Sui-Specific Patterns (SUI-01 to SUI-22)

Sui's object-centric model creates an attack surface that doesn't exist anywhere else:

Aptos-Specific Patterns (APT-01 to APT-21)

Aptos's global storage model has its own class of bugs:

DeFi Attack Vectors (DEFI-01 to DEFI-10)

For any Move protocol touching tokens, swaps, lending, or oracles:

• Oracle manipulation (spot price, TWAP staleness, circular dependencies)
• Flash loan attack surface and composability risks
• First-depositor attacks on liquidity pools
• Liquidation mechanism abuse and reward calculation errors
• Governance/timelock bypass patterns

---

5. Every Check Has Vulnerable + Safe Code

This is a rule I set for the repo: no check gets added without a concrete code example showing both the vulnerable pattern and the fix. Abstract descriptions are useless when you're reviewing actual code.

Every check follows this pattern. You see the bug, you see the fix. No ambiguity.

---

6. The Report Format

Each finding in the output follows a consistent structure:

Severity table at the top, PoC scenario for every finding, verified clean checks at the bottom. Consistent every time.

---

7. The Roadmap — and Why Benchmarking Matters Most

Here's what's planned:

• Vulnerability database — real-world Move CVEs and audit contest findings, tagged by pattern
• Protocol-specific patterns — Cetus, Aftermath, Turbos on Sui; Thala, Aries, Echelon on Aptos
• Automated grep patterns — lightweight static analysis for common Move anti-patterns
• Report templates — different formats for private audits vs. contest submissions
• Benchmarking — the big one

This is the item on the roadmap I'm most interested in. Open-sourcing code is easy. Proving it works is harder. The benchmarking results will be published alongside the skill so anyone can verify the claims.

---

8. What This Doesn't Replace

If you treat AI output as final, you will ship false positives and miss real bugs. The skill is designed to surface candidates faster — you still need to verify, test, and think.

---

9. How to Contribute

The repo is MIT licensed and contributions are welcome:

• New common checks go in common-move.md
• Sui-specific checks go in sui-patterns.md — numbered SUI-XX
• Aptos-specific checks go in aptos-patterns.md — numbered APT-XX
• DeFi vectors go in defi-vectors.md — numbered DEFI-XX

Every new check must include a code example showing both the vulnerable and safe pattern. No exceptions.

---

The skill is at github.com/pantheraudits/move-auditor. If you audit Move contracts, try it on your next review and tell me what it catches that you wouldn't have found otherwise. That's the only metric that matters.

— Panther · GitHub · Telegram