Preamble (run first)
# Suiperpower telemetry. Routes through the CLI so projects.json + Convex stay in sync.
# Silent on failure so the skill never blocks. Opt out: SUIPERPOWER_TELEMETRY=off.
#
# AGENT NOTE: when this skill finishes, run the matching completion command:
# suiperpower track ottersec-prep build completed
# Or use "failed" / "aborted" if it ended that way.
command -v suiperpower >/dev/null 2>&1 && suiperpower track ottersec-prep build started >/dev/null 2>&1 &
true
If TEL_PROMPTED is no, before doing real work, ask the user:
Help suiperpower get better. We track which skills get used and how long they take. No code, no file paths, no PII. Change anytime in
~/.suiperpower/config.json.A) Sure, anonymous B) No thanks
Write the answer to ~/.suiperpower/config.json telemetryTier field and create ~/.suiperpower/.telemetry-prompted. Then continue.
What this skill does
Walks the OtterSec pre-audit checklist on the user's Move package, surfaces the gaps, and produces the engagement package the auditor expects (threat model, architecture diagram outline, test report, known-issues doc). The goal is for audit time to be spent on real findings, not on hygiene noise.
When to use it
- About to engage OtterSec or another Sui Move auditor.
- Wanting to self-assess audit readiness.
- Preparing the audit-prep portion of a Sui Overflow submission targeting the OtterSec track.
When NOT to use it
- Pre-MVP code where auditing is premature; use
review-movefor an in-house P0-P3 walk first. - If the project does not have any Move code yet, use
build-with-movefirst. - For non-Move security questions (frontend XSS, key custody for sponsor wallets), use the relevant build skill.
If you activated this and the user actually wants something else, consult skills/SKILL_ROUTER.md and hand off.
Inputs
- A Sui project with at least one Move package under
move/or similar. - Optional:
.suiperpower/build-context.mdand any priorreview-moveoutput.
If unclear, interview the user for:
- Which packages are in scope for the audit?
- Target deploy: which network, what value at risk?
- Are there parts the user explicitly does not want audited (test scaffolding, prototypes)?
- What is the timeline for the audit and the deploy?
Outputs
A filled-in pre-audit checklist (every P0 item answered, P1-P3 documented).
A
THREAT_MODEL.mdin the project: who is trusted, what are the assets, what are the known risks.An architecture summary (which modules talk to which, where capabilities flow).
A test-coverage report from
sui move test.A
KNOWN_ISSUES.mdlisting decisions to ship despite known concerns.Append to
.suiperpower/build-context.md:## ottersec-prep session, <timestamp> - packages in scope: <list> - checklist completion: <P0 percent>, <P1 percent> - threat model doc: <path> - test count: <n>, coverage: <percent> - open issues: <list>
The skill never deletes files outside the integration source path without explicit user confirmation.
Workflow
Context gathering
- Read
.suiperpower/build-context.mdif present. - Confirm the package(s) in scope and the deploy target.
- Read
P0 walk
- Step through every P0 item from
skills/data/guides/security-checklist.md. - For each, mark pass / fail / not-applicable with a one-line note.
- For fails, propose a fix and let the user decide whether to fix now or document as known.
- Step through every P0 item from
Capability inventory
- List every
*Capstruct in the package(s). - For each, document: who creates it, who holds it, who can pass it to whom, whether it leaks via Display or public read.
- List every
Visibility audit
- Confirm
public(package)is the default;publicis reserved for true cross-package APIs. - Flag any leftover
frienddeclarations; recommend migration. - Confirm
#[test_only]on test helpers.
- Confirm
Init function audit
- Confirm one-time witness pattern intact.
- Confirm init does not leak capabilities outside its intended distribution.
- Confirm reinitialization is impossible (no shared init paths that can be re-entered).
Test coverage
- Run
sui move test, capture output. - Confirm every public entry function has at least one positive and one expected-failure test (where applicable).
- Run
Build cleanliness
- Run
sui move build. Confirm zero warnings. - Strip
assert!(false), commented-out checks, andstd::debug::printfrom production paths. - Confirm error codes are named constants, not magic numbers.
- Run
Dependency pin
- Confirm
Move.tomluses pinned revs / tags. Rejectmainor floating versions in production deps.
- Confirm
Threat model + known issues
- Help the user write
THREAT_MODEL.mdandKNOWN_ISSUES.mdif absent. - Surface assumptions the auditor needs to know.
- Help the user write
Engagement package
- Compose the audit submission: repo URL, scope, threat model, architecture, test report, checklist, known issues.
- Surface the OtterSec contact path (
https://osec.io/).
Writeback
- Append session details to
.suiperpower/build-context.md.
- Append session details to
Quality gate (anti-slop)
Before reporting done, the skill asks itself the following and refuses to declare success if any answer is no:
- Is every P0 item from the security checklist explicitly marked pass / fail / N/A with a note?
- Has every public entry function been mapped to at least one happy-path test and one expected-failure test where applicable?
- Is
THREAT_MODEL.mdnon-trivial (assets, trust assumptions, known risks named)? - Is the capability inventory complete (every
*Caplisted with holder strategy)? - Is
Move.tomlpinned, nomainin production deps? - Is the engagement package something the user could send to OtterSec today without a follow-up "actually, I forgot..."?
If any answer is no, the skill reports the gap and works through it before claiming the package is audit-ready.
References
On-demand references (load when relevant to the user's question):
references/pre-audit-walkthrough.md: Item-by-item walk of the checklist with example pass/fail patterns.references/finding-categories.md: Common findings OtterSec produces, with mitigation patterns.references/threat-model-template.md: One-page threat-model template.
Knowledge docs (load when scope expands beyond what is in references):
skills/data/sui-knowledge/sponsor-docs/ottersec-checklist.md: Full checklist source.skills/data/guides/security-checklist.md: P0-P3 reference.
Use in your agent
- Claude Code:
claude "/suiper:ottersec-prep <your message>" - Codex:
codex "/ottersec-prep <your message>" - Cursor: paste a chat message that includes a phrase like "prepare for OtterSec audit", or load
~/.cursor/rules/ottersec-prep.mdcand reference it.
If you activated this and the user actually wants something else, consult skills/SKILL_ROUTER.md and hand off.