skills.rest
PlamenTSV
PlamenTSVCOMMUNITY
Explore all skills by this author →
𝕏@p_tsanevGitHub

dependency-audit

Audit Move.toml dependencies for risk, immutability, and upgrade impact.

276|56|Updated Mar 16, 2026
Search Tags:#security#audit#move#risk#dependency#sui
One-click install
npx skills add https://github.com/PlamenTSV/plamen --skill dependency-audit-plamentsv
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dependency-audit
Source: https://github.com/PlamenTSV/plamen/tree/main/agents/skills/sui/dependency-audit
Command: npx skills add https://github.com/PlamenTSV/plamen --skill dependency-audit-plamentsv

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps security teams identify and assess risks in Move dependencies used by Sui projects, including third-party libraries and on-chain packages, to prevent upgrade surprises and supply-chain issues.

Core Features & Use Cases

  • Dependency Inventory: Build a complete Move.toml dependency map and identify transitive implications.
  • Immutability & Pinning Checks: Verify that third-party deps are pinned to specific revisions and evaluate on-chain upgrade policies.
  • Transitive Dependency Risk: Analyze the full dependency tree for potential risk propagation and version conflicts.
  • Math Library Audit: Conduct critical evaluation of custom math libraries for bit-shift safety, overflow risks, and rounding consistency.
  • Shared Object Dependencies: Assess the impact of external shared objects and their upgrade policies on protocol behavior.
  • Interface Compatibility: Check for potential ABI/return-value changes that could affect protocol modules on upgrade.
  • Use Case: Audit a Sui Move protocol to ensure third-party libs cannot unexpectedly alter critical behavior after upgrade.

Quick Start

Run the dependency-audit skill against your Move.toml-based project to generate a comprehensive dependency risk report.

Frequently Asked Questions about dependency-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit Move dependencies for security risks in Sui projects?▼

Auditing Move dependencies involves inventorying Move.toml packages, verifying third-party revision pinning, and analyzing transitive dependency trees to quantify supply-chain risks. The skill checks upgrade policies and shared object impacts to prevent unexpected protocol behavior changes.

What is transitive dependency risk in Sui Move and how does it propagate?▼

Transitive dependency risk in Sui Move propagates when upstream package updates introduce version conflicts or behavioral changes. The skill analyzes the full dependency tree to identify potential risk propagation from third-party libraries into your protocol modules.

How do I check Move.toml dependency pinning and immutability for Sui?▼

Checking Move.toml dependency pinning requires verifying that third-party dependencies are locked to specific revisions. The skill evaluates on-chain upgrade policies and immutability constraints to ensure external packages cannot unexpectedly alter critical protocol behavior.

Can I audit custom math libraries in Move for overflow and rounding issues?▼

Yes, you can audit custom Move math libraries for bit-shift safety, overflow risks, and rounding consistency. The skill evaluates critical math library functions to ensure arithmetic operations remain safe across dependency upgrades.

Does the dependency audit work with shared objects and upgrade policies on Sui?▼

The dependency audit works with Sui shared objects by assessing their upgrade policies and impact on protocol behavior. It checks interface compatibility for potential ABI and return-value changes that could affect protocol modules during upgrades.

What are the limitations of auditing Move dependencies without documented upgrade policies?▼

Without documented upgrade policies and explicit dependency pinning, the audit cannot fully guarantee protection against supply-chain issues. The skill requires defined risk assessment workflows and pinned third-party dependencies to accurately quantify transitive and upgrade risks.

Related Skills

Explore More Software Engineering Skills→
MystenLabsMystenLabs
20

move-setup

Automate Move package setup, edition configuration, and build/test workflows.

Official
Intermediate
yckkkkyckkkk
1

cso

Audit code, dependencies, CI/CD pipelines, and AI interactions for security gaps.

Community
Advanced
0x-Shashi0x-Shashi
56

Sui Smart Contract Security Scanner

Map Sui Move object ownership and lifecycle to surface security vulnerabilities.

Community
Advanced
7a336e6e7a336e6e
1

auditing-dependencies

Analyze third-party libraries for vulnerabilities and supply chain risks.

Community
Intermediate