dual-replay
Run Sui dual execution replay between base and tip commits, recover failed steps, build, and commit replay instrumentation.
Browse reusable Agent Skills, each with a clear purpose and practical guidance.
Run Sui dual execution replay between base and tip commits, recover failed steps, build, and commit replay instrumentation.
Pointer to the official Mysten Labs skills for building on Sui — language fundamentals, object model, PTBs, SDKs, publishing, upgrades, frontend integration, accessing on-chain data. Maintained upstream at github.com/MystenLabs/skills; pinned to the same ref the audit catalog derives from (see maintenance/UPSTREAMS.md). Trigger on "build a contract", "publish a package", "upgrade a module or package", "use the TypeScript SDK", "write a PTB", "set up a Sui client".
Safely modify or verify Sui protocol config changes, including version bumps, release-branch checks, guards, and snapshots.
Debug deterministic Sui simtest failures with structured experiments, logging-only changes, and NOTEBOOK.md observations.
Use to get bytecode for a deployed Sui package and produce a disassembled working view. One GraphQL call fetches every module's raw bytecode bytes; `sui move disassemble` (already on the system, running `sui prompt`) produces `.asm` files for analysis. Trigger on "fetch this package's bytecode", "get me the .mv for package X", "disassemble this package", or "I need to read a deployed Sui package".
Use when auditing, reviewing, or hunting for vulnerabilities in Move code on Sui. Applies equally to source code (.move files) and to disassembly of compiled bytecode (on-chain packages). A checklist of invariants whose VIOLATION causes exploitable bugs: access control & capabilities, struct abilities & type safety, object lifecycle & ownership, shared-object and PTB attack surface, dynamic fields & collections, arithmetic & coins, init/OTW/package upgrades, hot-potato composability, time & on-chain randomness, and test-only code leakage. Trigger on "audit this Move code", "find vulnerabilities in this Sui contract", "security review", "is this package safe?", "I suspect there's a bug in X", "something is wrong with this contract", or when reasoning about whether a Move function can be abused.
Review a GitHub pull request by summarizing its diff and key design decisions. Use when the user wants to review a PR, understand changes in a branch, or get a code review summary. Trigger keywords - review PR, review pull request, summarize PR, summarize diff, code review, review branch, PR summary, diff summary.
Given a GitHub issue, review the issue for security implications. You'll make a determination if the claim in the issue is legitimate and should be addressed or will be a "won't fix." Trigger keywords - security issue, review security ticket, review security issue.
Detect and fix drift across agent-first infrastructure files. Ensures skill inventories, workflow chains, architecture tables, issue/PR templates, and cross-references stay consistent when skills, crates, or workflows change. Run after adding, removing, or renaming skills or components. Trigger keywords - sync agent infra, sync skills, update agent docs, check agent consistency, agent infra drift, sync contributing, sync agents.
Watch and monitor GitHub Actions workflow runs using the gh CLI. Use when the user wants to check workflow status, watch a running workflow, view CI/CD jobs, or monitor build progress. Trigger keywords - watch pipeline, pipeline status, CI status, check build, monitor CI, view pipeline, pipeline progress, workflow status, actions status.