ClawHub
Back to skill

Security audit

Modernize Move

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly scoped Move smart-contract modernization guide with user confirmation and test gates before code changes.

Before installing, understand that this skill is meant to edit existing Move contracts. Use it on a version-controlled project, review the analysis report carefully, and avoid approving full Tier 3 migrations unless you are ready for possible ABI, storage, or event-stream breaking changes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Whitespace Padding

Medium
Category
Prompt Injection
Content
## Tier Quick Reference

| Tier                    | What Changes                                                           | Risk        | Examples                                                                                                                                                          |
| ----------------------- | ---------------------------------------------------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 1 — Syntax              | Code reads differently, compiles identically                           | Zero        | `vector::borrow(&v, i)` → `v[i]`, `x = x + 1` → `x += 1`, `while (i < n) { ... i += 1 }` → `for (i in 0..n) { ... }`                                              |
| 2 — Visibility & Errors | Same semantics, cleaner declarations                                   | Low         | `public(friend)` → `package fun`, magic numbers → `E_*` constants                                                                                                 |
Confidence
70% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium
Category
Prompt Injection
Content
| Tier                    | What Changes                                                           | Risk        | Examples                                                                                                                                                          |
| ----------------------- | ---------------------------------------------------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 1 — Syntax              | Code reads differently, compiles identically                           | Zero        | `vector::borrow(&v, i)` → `v[i]`, `x = x + 1` → `x += 1`, `while (i < n) { ... i += 1 }` → `for (i in 0..n) { ... }`                                              |
| 2 — Visibility & Errors | Same semantics, cleaner declarations                                   | Low         | `public(friend)` → `package fun`, magic numbers → `E_*` constants                                                                                                 |
| 3 — API Migrations      | Different APIs, same intended behavior. Most are **breaking changes**. | Medium-High | `coin` → `fungible_asset`, `SmartTable` → `BigOrderedMap`, `EventHandle` → `#[event]`, manual loops → stdlib `v.for_each_ref()`/`v.map()`/`v.fold()` with lambdas |

See [detection-rules.md](references/detection-rules.md) for the complete rule catalog (22 rules across 3 tiers).
Confidence
70% confidence
Finding
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Static analysis

No suspicious patterns detected.