Sui Auto Test

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a coherent Sui Move coverage and testing helper, but it runs local tools and may commit repository changes when used.

Before installing or invoking this skill, make sure you are comfortable with it reading your Sui Move project, running local Sui coverage/test commands, writing coverage reports or tests, and potentially creating a Git commit. Prefer using a feature branch and review diffs before pushing any changes.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent may create commits in the user's repository, changing local project history.

Why it was flagged

The skill instructs the agent to stage and commit repository changes after writing tests. This matches the test-improvement purpose, but it is a persistent local mutation users should review.

Skill content

Always commit test improvements:
```bash
git add sources/ tests/
git commit -m "Improve test coverage for <module>"
```

Recommendation

Use a branch and ask the agent to show diffs before committing, especially in shared or production repositories.

Low

#ASI05: Unexpected Code Execution

What this means

Using the skill can execute local Sui coverage commands in the selected package directory.

Why it was flagged

The tool spawns the local Sui CLI with a fixed argument list. This is expected for Sui coverage analysis and does not use a shell, but it still runs local commands.

Skill content

os.execvp('sui', ['sui', 'move', 'coverage', 'source', '--module', module_name])

Recommendation

Run it only in trusted project directories and review the command context before letting it modify files.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users may need to manually verify the included scripts and ensure the expected local tools are installed.

Why it was flagged

The registry metadata provides limited provenance and does not declare the Sui/Python tooling that SKILL.md relies on. No hidden download or remote install behavior is shown, so this remains a notice-level issue.

Skill content

Source: unknown; Homepage: none; Required binaries (all must exist): none

Recommendation

Confirm the skill files are the ones you intend to use, and install/use the Sui CLI and Python from trusted sources.