solana-dev@r1

CAUTION

Publisher claims: "Use when user asks to "build a Solana dapp", "write an Anchor program", "create a token", "debug Solana errors", "set up wallet connection", "test my Solana program", "fuzz my Solana program", "deploy to devnet", "send a v1 transaction", "support larger transactions", "fix maxSupportedTransactionVersion", or "explain Solana concepts" (rent, accounts, PDAs, CPIs). Also for program architecture — state layout, reducing compute units, throughput bottlenecks, instruction naming — and quick on-chain lookups via public RPC + curl (balance, transaction, token account). End-to-end playbook: wallet connection, Anchor/Pinocchio programs, Codama clients, Surfpool/LiteSVM/Mollusk testing, security review, and the v1 transaction format (SIMD-0385, 4096-byte transactions). Prefers @solana/kit 8 plugin clients (createClient + .use()) building transaction v1 by default, @solana/kit-plugin-wallet + @solana/react for wallets, web3.js v3 as the legacy migration target, and Surfpool for local networks." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry skills.shPublisher solana-foundation · joined 1 days agoInstalls 95,386Last detonated 29 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

HIGH

Process kill commandreferences/programs/design-patterns.md:174 · Process kill command — agent can terminate processes

AST05

CRITICAL

Access to sensitive file pathsreferences/frontend.md:44 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Outbound HTTP to raw IP addressreferences/surfpool/cheatcodes.md:91 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

CRITICAL

Pipe-to-shell patternreferences/surfpool/overview.md:42 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

HIGH

Outbound HTTP to raw IP addressreferences/kit/plugins.md:207 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressreferences/kit/plugins.md:71 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

CRITICAL

Pipe-to-shell patternreferences/testing.md:228 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

CRITICAL

Access to sensitive file pathsreferences/surfpool/kit-plugin.md:240 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Outbound HTTP to raw IP addressreferences/common-errors.md:283 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

npx invocation of non-well-known packagereferences/kit-web3-interop.md:23 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Pipe-to-shell patternreferences/anchor/migrating-v0.32-to-v1.md:481 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

CRITICAL

Pipe-to-shell patternreferences/testing.md:463 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

HIGH

Outbound HTTP to raw IP addressreferences/surfpool/cheatcodes.md:8 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Process kill commandreferences/programs/design-patterns.md:30 · Process kill command — agent can terminate processes

AST05

HIGH

npx invocation of non-well-known packagereferences/kit-web3-interop.md:21 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Process kill commandreferences/common-errors.md:251 · Process kill command — agent can terminate processes

AST05

HIGH

npx invocation of non-well-known packageSKILL.md:150 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Outbound HTTP to raw IP addressreferences/surfpool/cheatcodes.md:114 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

CRITICAL

Pipe-to-shell patternreferences/common-errors.md:264 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

HIGH

Outbound HTTP to raw IP addressreferences/surfpool/kit-plugin.md:178 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressreferences/surfpool/overview.md:267 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

Remote installer piped to shellreferences/anchor/migrating-v0.32-to-v1.md:481 · Remote installer piped to shell

AST07

HIGH

Outbound HTTP to raw IP addressreferences/surfpool/overview.md:279 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)SKILL.md:147 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

HIGH

Outbound HTTP to raw IP addressreferences/surfpool/overview.md:649 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressreferences/surfpool/kit-plugin.md:247 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressreferences/surfpool/overview.md:654 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)SKILL.md:144 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

HIGH

npx invocation of non-well-known packagereferences/testing.md:454 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

Outbound HTTP to raw IP addressreferences/surfpool/overview.md:662 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressreferences/surfpool/cheatcodes.md:134 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressreferences/surfpool/cheatcodes.md:138 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

URL using raw IP addressreferences/kit/plugins.md:71 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

Outbound HTTP to raw IP addressreferences/testing.md:238 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)SKILL.md:150 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

HIGH

Outbound HTTP to raw IP addressreferences/surfpool/kit-plugin.md:185 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

Remote installer piped to shellreferences/common-errors.md:264 · Remote installer piped to shell

AST07

MEDIUM

URL using raw IP addressreferences/common-errors.md:283 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressreferences/surfpool/kit-plugin.md:247 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressreferences/surfpool/overview.md:662 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressreferences/surfpool/kit-plugin.md:185 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressreferences/surfpool/cheatcodes.md:91 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressreferences/surfpool/cheatcodes.md:8 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressreferences/surfpool/kit-plugin.md:178 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

Remote installer piped to shellreferences/testing.md:228 · Remote installer piped to shell

AST07

MEDIUM

URL using raw IP addressreferences/surfpool/overview.md:267 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressreferences/surfpool/overview.md:654 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressreferences/surfpool/overview.md:279 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

Remote installer piped to shellreferences/testing.md:463 · Remote installer piped to shell

AST07

MEDIUM

URL using raw IP addressreferences/kit/plugins.md:207 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressreferences/testing.md:238 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressreferences/surfpool/cheatcodes.md:134 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressreferences/surfpool/overview.md:649 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressreferences/surfpool/cheatcodes.md:138 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

Remote installer piped to shellreferences/surfpool/overview.md:42 · Remote installer piped to shell

AST07

MEDIUM

URL using raw IP addressreferences/surfpool/cheatcodes.md:114 · URL using raw IP address — may bypass domain-based filtering

AST07