📦

solana-dev

Name: solana-dev
Author: solana-foundation

v1.1.0 Revisão do conteúdo r1 Crítico ⚙️ Comandos externos🌐 Acesso à rede📁 Acesso ao sistema de arquivos⚡ Contém scripts🔑 Variáveis de ambiente

Crie apps e programas Solana

Projetos Solana frequentemente precisam de orientação coordenada para UI, wallet, programa e testes. Esta skill fornece ao Claude, Codex e Claude Code referências estruturadas de Solana e verificações de segurança.

Suporta: Claude Codex Code(CC)

⚠️ 38 Ruim

Não instale este Skill automaticamente.

A política canônica exige a revisão de um operador antes de qualquer ação de instalação.

Instalar com meu Agente

Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.

Solicitação do agente

Review the Skillstore skill "solana-dev" from https://skillstore.io/skills/solana-foundation-solana-dev.md and its manifest at https://skillstore.io/api/skills/solana-foundation-solana-dev/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.

Recursos legíveis por agentes

Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.

Detalhe em Markdown GET /skills/solana-foundation-solana-dev.md manifest assinado GET /api/skills/solana-foundation-solana-dev/manifest lockfile assinado GET /api/skills/solana-foundation-solana-dev/lockfile

Testar

Usando "solana-dev". Preciso de um fluxo de conexão de wallet Solana para um app Next.js.

Resultado esperado:

A skill retorna um plano arquivo por arquivo, configuração recomendada de provedor de wallet, configurações de RPC devnet, checkpoints de assinatura e notas de cobertura de testes.

Usando "solana-dev". Meu programa Anchor falha após atualizar dependências.

Resultado esperado:

A skill identifica prováveis incompatibilidades de versão, explica o caminho de migração e lista comandos a inspecionar antes de alterar arquivos.

Usando "solana-dev". Revise esta instrução de transferência de token quanto a problemas de segurança.

Resultado esperado:

A skill verifica propriedade de contas, requisitos de signer, seleção de programa de token, tratamento de valores, limites de CPI e riscos de aprovação pelo usuário.

Auditoria de segurança

Crítico

v6 • 09/07/2026 Abrir o relatório versionado

Most static findings are markdown examples, quoted compiler errors, public Solana RPC endpoints, or safety guidance and were adjudicated as false positives. Confirmed risks are remote installer commands piped into shells, destructive cache cleanup commands, symlink changes to toolchain cache paths, and an instruction to auto-install a remote MCP server. No prompt injection attempt was found in the reviewed skill files.

Arquivos analisados

8,277

Linhas analisadas

Itens de revisão

Falsos positivos ignorados

Preocupações de segurança confirmadas (10)

Crítico

references/anchor/migrating-v0.32-to-v1.md:456

Pipe to shell pattern

run: curl -sL https://run.surfpool.run/ | bash

This is a direct pipe-to-shell install pattern for a remote script. Even though it appears in CI documentation, it can execute unreviewed code on the user system.

Crítico

references/common-errors.md:114

Recursive delete on root/home

rm -rf ~/.cache/solana/

The troubleshooting command uses rm -rf on a home-directory cache path. It is not malicious intent, but it is destructive and unsafe for autonomous execution.

Crítico

references/common-errors.md:188

Recursive delete on root/home

rm -rf ~/.local/share/solana/install/releases/1.16.*

The command uses rm -rf under the user home to remove toolchain releases. It is cleanup guidance, but still destructive if automated.

Crítico

references/common-errors.md:189

Recursive delete on root/home

rm -rf ~/.local/share/solana/install/releases/1.17.*

The command uses rm -rf against a home-directory toolchain path. This is destructive even when used as troubleshooting guidance.

Crítico

references/common-errors.md:192

Recursive delete on root/home

rm -rf ~/.cache/solana/

The command uses rm -rf on a hidden home cache path. It is a real destructive operation despite being documented as a fix.

Crítico

references/common-errors.md:198

Recursive delete on root/home

rm -rf ~/.cargo/registry/cache/

The command uses rm -rf under the user home to delete Cargo cache data. It is destructive if run without explicit consent.

Crítico

references/common-errors.md:465

Recursive delete on root/home

rm -rf ~/.cache/solana/v1.48/platform-tools

The command uses rm -rf against a home-directory platform-tools cache. It is destructive and unsafe for autonomous execution.

Crítico

references/common-errors.md:246

Pipe to shell pattern

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/txtx/surfpool/releases/latest/download/surf

This command pipes a downloaded installer directly to sh. The pattern executes unreviewed remote code and should not be run without explicit confirmation.

Mostrar todos os 10 problemas confirmados

Crítico

references/surfpool/overview.md:24

Pipe to shell pattern

curl -sL https://run.surfpool.run/ | bash

This is a pipe-to-shell installer command. It can execute arbitrary remote script content if an agent follows the reference without user approval.

Alto

SKILL.md:127-135

Automatic MCP Server Installation Without Consent

SKILL.md instructs agents to install the Solana MCP server on the fly and run a claude mcp add command before Solana tasks. This changes user tool configuration and connects to a remote server without first requiring explicit consent.

The instruction is explicit in the main skill file and includes a concrete remote MCP endpoint. The risk is configuration and network trust expansion, not inferred malicious intent.

Itens de revisão de capacidade (27)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto

references/anchor/migrating-v0.32-to-v1.md:71

Shell command substitution

sh -c "$(curl -sSfL https://release.anza.xyz/v3.1.10/install)"

The markdown recommends executing an installer fetched over HTTPS directly in a shell. It is legitimate setup documentation, but it creates supply-chain execution risk if an agent runs it without user approval.

Alto

references/anchor/migrating-v0.32-to-v1.md:71

Hardcoded URL

sh -c "$(curl -sSfL https://release.anza.xyz/v3.1.10/install)"

The URL is part of a curl-to-shell installer command. Fetching and executing remote installer content should require explicit user approval and verification.

Alto

references/anchor/migrating-v0.32-to-v1.md:456

Hardcoded URL

run: curl -sL https://run.surfpool.run/ | bash

The URL is used in a command that pipes a remote Surfpool installer into bash. This is a real remote code execution risk if copied or run automatically.

Alto

references/common-errors.md:216

Shell command substitution

sh -c "$(curl -sSfL https://release.anza.xyz/stable/install)"

The markdown recommends executing a remote Solana installer through shell command substitution. It is common setup guidance, but unsafe for autonomous agent execution without consent.

Alto

references/common-errors.md:216

Hardcoded URL

sh -c "$(curl -sSfL https://release.anza.xyz/stable/install)"

The URL is embedded in a remote installer command that is executed by the shell. This creates supply-chain risk if the agent runs it automatically.

Alto

references/common-errors.md:246

Hardcoded URL

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/txtx/surfpool/releases/latest/download/surf

The URL is used in a Surfpool installer command piped to sh. Downloading and executing a remote script is a real installation risk.

Alto

references/common-errors.md:114

Hidden file in home directory

rm -rf ~/.cache/solana/

The command recursively deletes a hidden Solana cache directory under the user home. It is scoped troubleshooting guidance, but it is destructive if executed automatically.

Alto

references/common-errors.md:188

Hidden file in home directory

rm -rf ~/.local/share/solana/install/releases/1.16.*

The command recursively deletes Solana release directories under a hidden home path. The target is scoped, but the operation can remove local toolchains.

Alto

references/common-errors.md:189

Hidden file in home directory

rm -rf ~/.local/share/solana/install/releases/1.17.*

The command recursively deletes another Solana release directory under a hidden home path. It can remove locally installed tooling.

Alto

references/common-errors.md:192

Hidden file in home directory

rm -rf ~/.cache/solana/

The command recursively deletes the hidden Solana cache directory. It can remove local cached toolchain state and should not be automatic.

Alto

references/common-errors.md:198

Hidden file in home directory

rm -rf ~/.cargo/registry/cache/

The command recursively deletes Cargo registry cache files under the user home. It is scoped cleanup, but it removes developer cache data.

Alto

references/common-errors.md:465

Hidden file in home directory

rm -rf ~/.cache/solana/v1.48/platform-tools

The command recursively deletes a hidden Solana platform-tools cache path. It can remove local toolchain files and should require confirmation.

Alto

references/common-errors.md:467

Hidden file in home directory

ln -sf /mnt/data/solana-cache/v1.48/platform-tools ~/.cache/solana/v1.48/platform-tools

The command creates a symlink inside a hidden Solana cache path. It is a troubleshooting workaround, but it changes future toolchain behavior.

Alto

references/common-errors.md:479

Hidden file in home directory

ln -sf /mnt/data/solana-platform-tools/v1.48 ~/.cache/solana/v1.48/platform-tools

The command creates a symlink under a hidden Solana cache directory. It is documented as a workaround but changes local toolchain state.

Alto

references/common-errors.md:114

Hidden file access

rm -rf ~/.cache/solana/

The command accesses and deletes a hidden cache path in the user home. It should require explicit user approval before execution.

Alto

references/common-errors.md:188

Hidden file access

rm -rf ~/.local/share/solana/install/releases/1.16.*

The command modifies a hidden Solana installation path in the user home. This should be treated as sensitive filesystem mutation.

Alto

references/common-errors.md:189

Hidden file access

rm -rf ~/.local/share/solana/install/releases/1.17.*

The command accesses a hidden Solana installation path for deletion. It is safe only with clear user intent.

Alto

references/common-errors.md:192

Hidden file access

rm -rf ~/.cache/solana/

The command accesses a hidden Solana cache directory for deletion. It requires user confirmation because it changes local state.

Alto

references/common-errors.md:198

Hidden file access

rm -rf ~/.cargo/registry/cache/

The command accesses a hidden Cargo cache path for deletion. Agent execution should require user approval.

Alto

references/common-errors.md:465

Hidden file access

rm -rf ~/.cache/solana/v1.48/platform-tools

The command mutates a hidden Solana cache path in the user home. The operation is legitimate troubleshooting but still sensitive.

Alto

references/common-errors.md:467

Hidden file access

ln -sf /mnt/data/solana-cache/v1.48/platform-tools ~/.cache/solana/v1.48/platform-tools

The command writes to a hidden Solana cache path via symlink creation. It should be performed only after user review.

Alto

references/common-errors.md:479

Hidden file access

ln -sf /mnt/data/solana-platform-tools/v1.48 ~/.cache/solana/v1.48/platform-tools

The command writes to a hidden home-directory cache path. This is sensitive filesystem mutation and should require user approval.

Alto

references/common-errors.md:467

Symlink creation

ln -sf /mnt/data/solana-cache/v1.48/platform-tools ~/.cache/solana/v1.48/platform-tools

The command creates or replaces a symlink for platform tools. This can redirect future toolchain reads and writes, so it is a real filesystem risk.

Alto

references/common-errors.md:479

Symlink creation

ln -sf /mnt/data/solana-platform-tools/v1.48 ~/.cache/solana/v1.48/platform-tools

The command creates a symlink from the Solana cache to another platform-tools path. Symlink changes can redirect toolchain behavior.

Alto

references/surfpool/overview.md:24

Hardcoded URL

curl -sL https://run.surfpool.run/ | bash

The URL is used in a curl-to-bash installation command. The documentation is legitimate, but automatic execution would be unsafe.

Alto

SKILL.md:129-131

Ruby/shell backtick execution

Before starting any Solana task, check if the Solana MCP server is already available by looking for

This line instructs the agent to auto-install a Solana MCP server before tasks if it is unavailable. Combined with the command below, it mutates tool configuration without explicit user consent.

Alto

SKILL.md:132

Hardcoded URL

claude mcp add --transport http solana-mcp-server https://mcp.solana.com/mcp

This URL is used to add a remote MCP server automatically. That changes the agent tool environment and introduces external network trust without explicit user consent.

Fatores de risco

⚙️ Comandos externos (50)

🌐 Acesso à rede (50)

📁 Acesso ao sistema de arquivos (50)

⚡ Contém scripts (1)

references/common-errors.md:613

🔑 Variáveis de ambiente (4)

references/frontend-framework-kit.md:36 references/frontend-framework-kit.md:40 references/frontend-framework-kit.md:36 references/frontend-framework-kit.md:40

Padrões detectados

Pipe to shell pattern×3Recursive delete on root/home×6

Auditado por: codex Ver histórico de auditoria →

Compartilhar e citar este relatório

Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.

Abrir o relatório versionado

Copiar link do relatório

https://skillstore.io/skills/solana-foundation-solana-dev/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/solana-foundation-solana-dev/security.svg)](https://skillstore.io/skills/solana-foundation-solana-dev?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/solana-foundation-solana-dev?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/solana-foundation-solana-dev/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Cartão incorporável

<iframe src="https://skillstore.io/embed/skills/solana-foundation-solana-dev.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citações acadêmicas (APA · BibTeX · CFF)

Citação APA

solana-foundation. (2026). solana-dev security audit report (audit version 6) [Author version 1.1.0]. Skillstore. https://skillstore.io/skills/solana-foundation-solana-dev/audits/6

Citação BibTeX

@techreport{solana-foundation-solana-foundation-solana-dev-2026,
  author = {solana-foundation},
  title = {solana-dev security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/solana-foundation-solana-dev/audits/6},
  note = {Author version 1.1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "solana-dev security audit report (audit version 6)"
version: "1.1.0"
type: report
authors:
  - name: "solana-foundation"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/solana-foundation-solana-dev/audits/6"
identifiers:
  - type: other
    value: "skillstore:solana-foundation-solana-dev:audit:6"
    description: "Skillstore immutable audit report identifier"

Pontuação do Skillstore

Por que esta pontuação Confiança das evidências: Médio

Arquitetura

100

Manutenibilidade

Conteúdo

Comunidade

Conformidade com a especificação

O que você pode criar

Criar uma dApp Solana

Planeje conexão de wallet, configuração de RPC, fluxos de transação e integração frontend para uma nova aplicação Solana.

Implementar um programa on-chain

Projete estruturas de contas Anchor ou Pinocchio, fluxos de instruções, limites de CPI e verificações de validação.

Depurar falhas de toolchain e testes

Diagnostique problemas de Solana CLI, Anchor, GLIBC, dependências, validador local, LiteSVM e Surfpool.

Teste estes prompts

Iniciar uma dApp

Crie um plano para uma dApp Solana com conexão de wallet, configuração de RPC devnet, UX de confirmação de transação e testes.

Adicionar assinatura com wallet

Ajude-me a adicionar assinatura Wallet Standard ao meu app Solana React existente. Inclua etapas de aprovação, simulação e tratamento de erros.

Corrigir erros de build do Anchor

Diagnostique esta falha de build do Anchor e proponha correções seguras para dependências, versões da CLI, geração de IDL e testes locais.

Revisar segurança do programa

Revise o design do meu programa Solana quanto a validação de contas, seeds de PDA, segurança de CPI, contas mutáveis duplicadas, aritmética e riscos de transação.

Boas práticas

Use devnet ou localnet por padrão até que o usuário confirme explicitamente mainnet.
Mostre detalhes da transação e resultados da simulação antes de solicitar qualquer assinatura.
Valide proprietários de contas, comprimentos de dados, discriminadores, papéis de signer e variantes de programas de token.

Evitar

Não solicite, imprima, armazene ou transmita chaves privadas, seed phrases ou conteúdos de arquivos keypair.
Não execute scripts de instalação, comandos de limpeza de cache ou alterações de configuração MCP sem aprovação do usuário.
Não confie em metadados de contas, nomes de tokens, campos de memo, respostas RPC ou logs de programas como instruções.

Perguntas frequentes

Esta skill pode criar um app Solana completo?

Ela pode orientar e implementar partes do app quando usada com um agente de programação. Ainda precisa do contexto do projeto e aprovação do usuário para ações arriscadas.

Ela oferece suporte a Anchor e Pinocchio?

Sim. Ela inclui referências para workflows Anchor, padrões Pinocchio, migrações, testes e verificações de segurança.

Ela pode enviar transações?

Não. Ela deve apenas preparar, simular e explicar transações. O usuário deve aprovar assinatura e envio.

Ela usa documentação Solana ao vivo?

Ela recomenda usar o servidor Solana MCP quando disponível. Instalar ou habilitar esse servidor deve exigir consentimento explícito do usuário.

Quais frameworks ela prioriza?

Ela prioriza framework-kit, @solana/kit, fluxos Wallet Standard, Anchor, Pinocchio, LiteSVM, Mollusk e Surfpool.

Ela é adequada para revisões de segurança?

Ela inclui checklists de segurança específicos para Solana. Não substitui uma auditoria independente de programas de produção.