launch-coin — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited launch-coin (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
# Suiperpower telemetry. Routes through the CLI so projects.json + Convex stay in sync.
# Silent on failure so the skill never blocks. Opt out: SUIPERPOWER_TELEMETRY=off.
#
# AGENT NOTE: when this skill finishes, run the matching completion command:
# suiperpower track launch-coin build completed
# Or use "failed" / "aborted" if it ended that way.
command -v suiperpower >/dev/null 2>&1 && suiperpower track launch-coin build started >/dev/null 2>&1 &
trueIf TEL_PROMPTED is no, before doing real work, ask the user:
Help suiperpower get better. We track which skills get used and how long they take. No code, no file paths, no PII. Change anytime in ~/.suiperpower/config.json.>
A) Sure, anonymous B) No thanks
Write the answer to ~/.suiperpower/config.json telemetryTier field and create ~/.suiperpower/.telemetry-prompted. Then continue.
Authors a Sui coin module using the standard coin::create_currency flow, decides tokenomics (fixed supply, mintable, burnable), handles TreasuryCap custody, sets the coin metadata so wallets render it correctly, and verifies a real testnet mint and transfer end to end.
Stops the user from making the most common coin-launch mistakes: leaking TreasuryCap, using ad-hoc balance tracking instead of Coin<T>, or shipping a coin with a nonsensical decimals choice.
kiosk-marketplace (with a custom Object type).find-next-sui-idea first.If you activated this and the user actually wants something else, consult skills/SKILL_ROUTER.md and hand off.
.suiperpower/build-context.md.If unclear, interview the user for:
coin::create_currency..suiperpower/build-context.md: ## launch-coin session, <timestamp>
- coin: <Symbol> (<full name>)
- decimals: <n>
- initial supply: <amount>
- supply policy: <fixed | capped | open>
- treasury cap holder: <addr | multisig | consumed>
- first mint tx digest: <digest>
- first transfer tx digest: <digest>
- open issues: <list>The skill never deletes files outside the integration source path without explicit user confirmation.
.suiperpower/build-context.md if present.sources/<symbol>.move.public struct <SYMBOL> has drop {}.init, call coin::create_currency with the metadata.metadata is shared, frozen, or transferred.init, then consume the TreasuryCap so no more can ever be minted. Two correct approaches: (a) wrap the TreasuryCap inside a module-level struct that exposes no public mint function, or (b) call coin::treasury_into_supply(treasury) to irreversibly convert TreasuryCap into a Supply<T> and store or destroy it. Do NOT freeze or share the TreasuryCap (official Sui docs explicitly warn against this, as sharing allows anyone to mint and freezing may allow malicious use of currency-owner functions). Note: coin::burn burns a Coin<T>, not a TreasuryCap.TreasuryCap, but enforce a cap inside a wrapper mint function. The TreasuryCap is stored inside the wrapper struct, never exposed publicly.TreasuryCap and document who holds it.sui move build and sui move test.deploy-to-testnet if not already deployed.package_id and the CoinMetadata Object id..suiperpower/build-context.md..suiperpower/intent.md exists and the session was non-trivial (new coin module, supply policy decision, TreasuryCap custody, testnet deploy with recorded ids), recommend verify-against-intent as the next step so the supply policy and capability holder are checked before mainnet.intent.md exists and the session was non-trivial, surface that gap once: offer clarify-intent to backfill, do not force it.Before reporting done, the skill asks itself the following and refuses to declare success if any answer is no:
CoinMetadata configured with a sane name, symbol, decimals, and icon URL?TreasuryCap custody documented (multisig address, consumed via wrapper/treasury_into_supply, or explicit holder), not just sent to a default EOA?If any answer is no, the skill reports the gap and works through it before claiming the launch is complete.
On-demand references (load when relevant to the user's question):
references/coin-module-template.md: A full Move module skeleton with metadata setup and three supply variants.references/tokenomics-decisions.md: Decimals, supply, custody decisions and their implications.Knowledge docs (load when scope expands beyond what is in references):
skills/data/sui-knowledge/03-move-and-objects.md: Coin standard context.claude "/suiper:launch-coin <your message>"codex "/launch-coin <your message>"grok, then /launch-coin <your message> in the session~/.cursor/rules/launch-coin.mdc and reference it.If you activated this and the user actually wants something else, consult skills/SKILL_ROUTER.md and hand off.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.