Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+21 more

    movescan

    1

    Static bug-pattern scanner for Move smart contracts on Aptos and Sui targeting resource safety and access control.

    $5

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    movescan

    movescan

    Example session with this skill installed

    Scan the ./contracts/liquidity_pool directory for any high-severity Move vulnerabilities.

    • Read your context and instructions
    • Compiled the movescan

    I have completed the static analysis of the /contracts/liquidity_pool directory using MoveScan. The scanner identified 3 findings, including one high-severity issue related to resource abilities.

    Move Security Scan Results

    SeverityDetectorFileLineFinding
    HIGHability-misusepool.move42Struct LPToken has copy and drop abilities.
    MEDIUMdiv-before-mulmath.move118Precision loss in calculate_reward: (amount / total_shares) * reward_rate.
    LOWcast-truncationvault.move89Narrowing cast from u128 to u64 in get_balance.

    Critical Finding: Ability Misuse

    In pool.move, the LPToken struct represents a claim on pool liquidity but is declared with both copy and drop. This allows an attacker or a buggy function to duplicate their shares or accidentally delete them, leading to a total loss of funds or infinite minting.

    Recommendation: Remove copy and drop from LPToken. It should only have store and key to ensure it behaves as a strictly regulated resource.

    Next steps

    • Remove the copy and drop abilities from the LPToken struct definition in pool.move.
    • Refactor math.move to perform multiplication before division to maintain decimal precision.
    • Implement a move test to verify that LPToken can no longer be duplicated using the copy keyword.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Move smart contracts bypass many Solidity-style vulnerabilities, but introduce unique risks around resource abilities and capability management. A manual review of a large Aptos or Sui repository is slow and error-prone. This skill automates the initial triage phase by scanning Move source code for specific, high-impact bug patterns.

    What it does

    • Detects ability misuse by flagging value-bearing structs like Coin or Balance that incorrectly implement copy or drop abilities.
    • Identifies access control gaps in public or entry functions that modify global state without proper signer verification.
    • Spots capability leaks where administrative capabilities are returned from public functions without authorization guards.
    • Flags precision loss by locating division-before-multiplication patterns in sensitive financial math like fee or interest calculations.
    • Catches truncation risks in narrowing integer casts (e.g., as u64) that could lead to silent data loss.

    How it works

    1. Run the movescan.scanner module against a specific Move project directory or individual .move file.
    2. Use the --min-severity flag to filter the noise and focus on high-risk vulnerabilities first.
    3. Review the generated list of files and line numbers to pinpoint specific logic flaws in the source.
    4. Verify findings manually against the code context to filter out false positives before reporting.

    Frameworks & tools

    This tool is built for Move smart contracts on the Aptos and Sui blockchains. It is a pure-Python static analyzer with no external dependencies, requiring only Python 3.9 or higher.

    Why this beats prompting it yourself

    Generic LLM prompts often miss Move-specific nuances like resource safety and struct abilities, leading to generic advice. This skill uses targeted pattern matching designed specifically for the Move VM, ensuring it catches structural flaws that general-purpose security prompts overlook.

    Use cases

    • Auditing a new Aptos or Sui repository before a mainnet deployment.
    • Identifying high-value targets in a codebase for bug bounty hunting.
    • Integrating a fast security check into a local development workflow.
    • Performing a first-pass triage on complex Move packages to guide manual review.

    Known limitations

    This is a pattern-based static analyzer, not a formal verifier or symbolic execution engine. It lacks cross-file resolution and a full type-checker, which may result in false positives.

    Pattern-based only. No cross-file resolution or full type-checking. Requires manual verification of findings to filter false positives.

    Open docs

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before any payment.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 25 days ago

    Requires

    Python

    Permissions

    Terminal / Shell
    Listed25 days ago

    What's inside

    Frequently Asked Questions

    movescan identifies Move-specific vulnerabilities like resource ability misuse (e.g., incorrectly allowing 'drop' on a Coin), missing signer checks in entry functions, and administrative capability leaks that general-purpose tools often miss.

    This skill is a standalone Python-based analyzer that can be integrated with any AI agent capable of running Python scripts or via CLI, requiring only Python 3.9+ and no external blockchain dependencies.

    Yes, the skill is specifically designed to handle the distinct architectural differences of both Aptos and Sui, including their unique approaches to global storage and object ownership.

    While movescan provides high-accuracy pattern matching for rapid triage, it is a static analyzer rather than a formal verification tool; it is intended to augment, not replace, a comprehensive manual security audit.

    Your purchase includes the core scanner module, documentation on vulnerability patterns, and access to future updates as new Move bug patterns are identified and added to the library.