sui-dev-agents

Use when integrating DeepBook V3 — SUI's native CLOB DEX, margin trading, prediction markets, or DEEP-token fee mechanics. Triggers on "DeepBook", "DBv3", "BalanceManager", "DEEP token", "order book", "CLOB", "limit order", "market order", "Pool", "margin trading", "perpetuals on Sui", "leverage", "TPSL", "take-profit / stop-loss", "flash loan on Sui", "prediction market", "predict", "DeepBook indexer", "Pyth price feed", "permissionless pool", or any on-chain trading / DEX / market-making integration on SUI. Use even when the user only says "I need an orderbook on Sui" or mentions building a DEX without naming DeepBook — DeepBook V3 is the canonical answer.

Use when building verifiable off-chain computation, integrating external APIs with on-chain proof, or running trusted execution environments on SUI. Triggers on Nautilus, off-chain oracle, "verify API data on-chain", "connect external API to Move", "prove off-chain result", trusted compute, AWS Nitro Enclave, attestation, price feed, weather data on-chain, or any scenario requiring cryptographically verified external data. Also use when the user asks "how do I get real-world data into my SUI contract" or needs an oracle-like pattern.

Use when writing TypeScript code interacting with SUI blockchain via @mysten/sui SDK. Covers PTB construction, client setup, transaction execution, and on-chain queries. Triggers on backend scripts, CLI tools, serverless functions, or any non-React TS SDK usage. For frontend-specific setup (dApp Kit, wallet adapters, React hooks), use sui-frontend skill alongside this one.

Use when bumping any @mysten/* SDK version, adding a new SDK-using skill, or diagnosing version-drift errors across the plugin. Defines the canonical compat matrix, banner spec, and SDK-bump audit SOP. Triggers on "@mysten upgrade", "SDK bump", "version drift", "banner format", "compat matrix".

Use when adding social login (Google/Twitch/Facebook OAuth) or gasless/sponsored transactions to a SUI app via Mysten's Enoki service. Triggers on Enoki, zkLogin-as-a-service, sponsored transaction, gasless transaction, "sign in with Google" on Sui, social login, OAuth wallet, sponsor gas, pay gas for users, sponsored tx API, EnokiClient, registerEnokiWallets, or onboarding users without seed phrases. For self-hosted zkLogin (proving service you run yourself), use sui-zklogin instead. For passkey/WebAuthn auth, use sui-passkey.

Sui frontend dApp development with @mysten/dapp-kit-react (React) and @mysten/dapp-kit-core (Vue, vanilla JS, other frameworks). Use when building browser apps that connect to Sui wallets, add a ConnectButton or wallet-connection UI, query on-chain data, execute or sign transactions in the browser, or migrate off the deprecated @mysten/dapp-kit package. Use alongside the sui-ts-sdk skill for PTB construction patterns.

Use when building NFT marketplaces, enforcing royalties, or managing transfer policies using SUI's Kiosk standard. Triggers on "Kiosk", "NFT marketplace", "transfer policy", "royalty enforcement", "list NFT for sale", "purchase rules", or any NFT commerce on SUI. Also use when the user asks about listing, delisting, or trading NFTs with enforced rules.

Use when bridging Move contracts to TypeScript — generating TS types from Move ABI, creating contract API wrappers, subscribing to on-chain events, or building E2E integration tests. Triggers on "generate types from Move", "event listener", "contract ABI", "Move to TypeScript", "subscribe to events", "ABI wrapper", or any Move↔frontend bridging task. This is the CONTRACT-TO-CODE BRIDGE, not project setup (sui-full-stack) or UI/wallet (sui-frontend).

Use when implementing WebAuthn passkeys or biometric authentication (Face ID, fingerprint, hardware keys) on SUI. Triggers on "passkey", "WebAuthn", "biometric login", "Face ID", "fingerprint auth", "FIDO2", or passwordless auth that uses device authenticators instead of seed phrases. Different from zkLogin (which uses OAuth providers).

Use when implementing data encryption, access control, or secrets management on SUI using the Seal protocol. Triggers on threshold encryption, data privacy, token-gated content, encrypted storage, decryption policies, paywall, gated access, encrypted NFT metadata, private data sharing, or any scenario requiring on-chain access control for off-chain data. Also use when the user mentions Seal, pay-to-decrypt, "only NFT holders can see", or subscriber-only content on SUI. Also covers on-chain encrypted messaging (the @mysten/messaging SDK — encrypted group channels, DMs, chat apps on SUI built on SEAL + Walrus): trigger on "encrypted messaging", "chat app on SUI", "on-chain DM", "group channel encryption", or "@mysten/messaging".

Use when integrating SuiNS (SUI Name Service) — resolving .sui names to addresses, reverse lookups, or registering names. Triggers on "SuiNS", ".sui name", "name resolution", "reverse lookup", "human-readable address", or any name service integration. Also use when the user wants to display user-friendly names instead of hex addresses.

Use when storing or retrieving files using Walrus — SUI's decentralized blob storage. Triggers on "Walrus", "blob storage", "upload file to chain", "decentralized storage", "store NFT image", "IPFS alternative on SUI", "where to store NFT metadata", "host a site on-chain", or any off-chain data storage needs on SUI. Also use for Walrus Sites (decentralized web hosting), storing game assets, media files, or when the user asks "where do I put large files on SUI". Also covers Walrus Memory (the @mysten-incubation/memwal beta SDK) — trigger on "Walrus Memory", "portable agent memory", "AI agent memory", "agent memory layer", "store agent memories", or giving an AI agent durable cross-session memory.

Use when implementing zkLogin on SUI — OAuth login (Google, Facebook, Apple, Twitch) with zero-knowledge proofs for privacy-preserving authentication. Triggers on "zkLogin", "social login on SUI", "Google login", "OAuth", "ephemeral keypair", "JWT proof", or any authentication flow that derives a SUI address from an OAuth provider. Also use when the user mentions "login without wallet extension".

Use when planning SUI Move architecture, generating technical specs, or designing object/module structure before writing code. Triggers on "design", "architect", "plan the contracts", "object model", "module structure", "how should I structure", or any SUI system design task. For new projects from scratch, use sui-full-stack (which calls this skill at Phase 1). For ecosystem tool/stack selection (Walrus vs IPFS, zkLogin vs Passkey), use sui-tools-guide.

Use when writing or modifying SUI Move smart contracts, generating Move code, or following Move development patterns. Triggers on "write a Move module", "implement contract", "add function", "Move code", or any hands-on Move development task. Also use when the user pastes Move code and asks for help. For code review/audit, use move-code-quality instead. For contract architecture design, use sui-architect.

Analyzes Move packages against the official Move Book Code Quality Checklist. Use when reviewing Move code quality, checking Move 2024 Edition compliance, auditing best practices, or when the user says "review my Move code", "check code quality", "Move lint", or "does this follow best practices". Activates automatically when working with .move files. Different from sui-developer (which writes code) — this skill reviews and audits existing code.

Use when deploying or upgrading Move packages to devnet/testnet/mainnet, managing UpgradeCaps, or planning deployment strategy. Triggers on "deploy", "publish", "upgrade package", "sui client publish", "mainnet release", "staged rollout", or any deployment/release task. Also use when the user asks about package versioning or upgrade compatibility.

Use when building custom indexers, data pipelines, or event processors for the SUI blockchain. Triggers on "indexer", "data pipeline", "backfill", "event processor", "index transactions", "analytics dashboard", "aggregate on-chain data", "historical query", "track all trades", or any custom data extraction from SUI chain history. Also use when the user needs to build dashboards from on-chain data, process historical transactions, or set up real-time event streams.

Use when writing Move tests, setting up test suites, running gas benchmarks, or planning test strategy for SUI contracts. Triggers on "write tests", "test this module", "#[test]", "test coverage", "gas benchmark", "property-based test", or any Move testing task. Use even for simple "how do I test this function" questions.

Use when performing adversarial security testing on SUI Move contracts — generating attack tests for access control bypass, integer overflow, object manipulation, economic exploits, reentrancy, and DoS vectors. Triggers on "red team", "attack test", "find vulnerabilities", "exploit", "pentest", "security test", or when the user wants to stress-test their contract's security. For defensive security setup (scanning, hooks, checklists), use sui-security-guard instead.

Use when starting a new SUI project from scratch or need end-to-end workflow orchestration (architecture → contracts → frontend → testing → deployment). This is the PROJECT ORCHESTRATOR that routes to specialized skills per phase. Triggers on "new project", "start from scratch", "full workflow", "what's the next step", or any multi-phase SUI development task. Do NOT use for Move↔TypeScript integration tasks (type generation, event handling) — that's sui-move-ts-bridge.

Use during product design and stack selection — choosing between SUI ecosystem tools and official building blocks (Walrus vs Arweave, zkLogin vs Passkey, DeepBook vs AMM, Kiosk vs custom marketplace). Triggers on "which SUI stack", "compare Walrus and IPFS", "what tools are available", "best library for", "which auth method", "storage options on SUI", or any SUI tool/library selection decision. This is for CHOOSING tools, not designing contract architecture (that's sui-architect).

Use when installing or updating the Sui CLI, managing CLI versions with suiup, or resolving environment/setup problems — "install sui", "update sui", "command not found", "sui not found", "client/server api version mismatch", build errors about "old dependencies", switching CLI versions per network, or installing toolchain components (Walrus, MVR, Move Analyzer, site-builder). Also use for first-time client setup, getting faucet tokens, recovering keys from a phrase, or "Cannot find gas coin for signer address". For deploying/upgrading packages use sui-deployer; for on-chain data queries use sui-ts-sdk.

Use when performing on-chain transactions (transfer, Move call, publish) through the agent's CLI wallet via MCP tools. Triggers on "transfer SUI", "call Move function", "publish package", "wallet status", "sign transaction", or any agent-driven on-chain operation. This is for headless/backend wallet operations — for browser wallet UI (React/Vue), use sui-frontend instead.

Use when setting up security scanning, detecting leaked secrets/API keys, implementing pre-commit hooks, or auditing a Sui Move contract for security/architecture/quality issues. Triggers on "security scan", "detect secrets", "pre-commit hook", "security audit setup", "API key leaked", and on contract-level review requests like "audit this contract", "review access control", "is this Move safe", "check for vulnerabilities", "Move security review" — these load the SEC/DES/PAT/TST/QA/CFG finding registry in references/move-security-findings.md. For offensive/adversarial testing (attack vector discovery, writing exploits/PoCs), use sui-red-team instead. For Move style/idiom quality (non-security), use move-code-quality.

Use when fetching or analyzing deployed SUI Move contract source code from on-chain bytecode. Triggers on "decompile", "show me the contract code", "reverse engineer", "read on-chain module", "analyze deployed package", or when the user provides a package ID and wants to understand what it does. Also use when studying existing protocols or verifying deployed code.

Use when searching SUI-specific documentation, querying Move framework API references, or checking SUI CLI/tool versions. Triggers on "check SUI docs", "what's the API for", "sui client command", "Move stdlib function", "sui move build flags", or any SUI/Move-specific documentation lookup. Prefer this over generic web search for SUI-specific questions — it routes to Context7 MCP with optimized SUI queries. For non-SUI library docs (React, Node, etc.), use context7 directly.