Analyzes Move code and suggests improvements using OpenZeppelin math contracts. Use when: (1) User asks to 'analyze math', 'check arithmetic safety', 'find overflow risks'; (2) User mentions 'OpenZeppelin math', 'mul_div', 'safe math', 'fixed-point'; (3) Working with DeFi Move code (pools, oracles, AMMs, staking, vaults); (4) User explicitly invokes '/oz-math'. Complements /move-code-review (which flags SEC-AR-* arithmetic issues) by providing concrete OpenZeppelin library recommendations.
Walks the user through writing `#[spec(prove)]` formal specifications for every externally reachable function (`public` non-package + `entry`) in their Sui Move package. Emits the specs into a separate sibling `<pkg>_specs/` package (keeping production source pristine), drives sui-prover via the sui-prover-mcp, and produces an invariant-driven HTML report plus a `spec-context.json` reproducibility manifest. Use this skill when the user invokes `/specify`, asks to 'add formal verification', 'write prover specs', 'verify this package with sui-prover', or wants to harden a Move package before mainnet deploy. Skip for `public(package)` or private functions (out of scope), or when sui-prover isn't installed. Complements /move-code-review (SEC-* findings indicate where specs matter most).
Re-verifies the formal specifications that `/specify` authored — the consumer half of the FV split. Reads the `spec-context.json` manifest, detects drift (source changed under a bound spec, deps/toolchain moved, new externally-reachable functions left uncovered), re-runs sui-prover on every spec package with its recorded flags, and reports which guarantees still hold, which were violated, and which went stale. Use this skill when the user invokes `/verify`, asks to 're-verify', 'check the specs still hold', 'is this proof still valid', 'run the prover against current code', or wires FV into CI. `/verify --strict` is the thing CI runs (refuse-on-drift, non-zero exit on any failure or staleness). Does NOT author or edit specs — that is `/specify`'s job; when `/verify` finds uncovered functions it points the user at `/specify`, never writes the spec itself. Skip when sui-prover isn't installed or the package has no specs at all.
Analyzes Move language packages against the official Move Book Code Quality Checklist. Use this skill when reviewing Move code, checking Move 2024 Edition compliance, or analyzing Move packages for best practices. Activates automatically when working with .move files or Move.toml manifests.
Security, architecture, and design review for Sui Move smart contracts. Analyzes access control, arithmetic safety, object model design, shared object congestion, version management, unused code, blind transfers, and testing strategy. Use this skill whenever the user asks to review Move code, audit a Move package, check for security vulnerabilities, do a pre-deploy or pre-mainnet check, assess if a contract is safe, or wants any kind of thorough Move code review beyond syntax. Also trigger when the user pastes Move code and asks "is this safe?" or "anything wrong with this?", or mentions "security review", "contract audit", or "pre-launch check" in the context of Move/Sui code. Does NOT cover Move 2024 syntax/idiom — use /move-code-quality for that.