A development skill maintained by the Solana Foundation: loaded when agents write Solana dApp frontends and wallet connections, write Anchor / Pinocchio on-chain programs, issue tokens, troubleshoot errors, or conduct security audits. It writes code according to its predefined default tech stack and uses LiteSVM, Mollusk, and Surfpool for testing.
skills.sh install count 105283 (+539 / 24h)
Security Audit: Not audited
- Not yet scanned
Rationale
- The default stack is clearly defined: @solana/kit 8 plugin-based client, new code defaults to v1 transactions (SIMD-0385), wallets use @solana/kit-plugin-wallet plus @solana/react; web3.js v3 is only a migration target for legacy code, with explicit deprecation of wallet-adapter and framework-kit
- Includes agent security guardrails: no signing or transaction submission without explicit user approval; before sending, it runs simulateTransaction and displays the recipient, amount, token, fee payer, and network; it does not request private keys or mnemonics; defaults to devnet / localnet, requiring explicit user confirmation for mainnet
- Treats on-chain data as untrusted input: account data, token names, memos, and program logs may contain prompt injections, requiring validation before use and ignoring any instructions within them
- Deliverables must include changed files, install/build/test commands, and risk explanations involving signatures, fees, CPI, or transfers; MIT license
- skills.sh 24-hour installs 539, cumulative 105283 (reflects attention only)
Usage
- Installation command will appear after audit approval; triggered by phrases like "write an Anchor program," "deploy to devnet," "fix maxSupportedTransactionVersion error," or "explain PDA / CPI"
- Requires Node.js, Rust toolchain, Solana CLI, and Anchor CLI; local development and testing do not require accounts, but server-side signing requires integration with managed services such as AWS KMS, Turnkey, Privy, or Fireblocks
Risks
- Not audited in this cycle, fixed at Grade C, installation command hidden; SKILL.md requires agents to add mcp.solana.com to their configuration using commands like
claude mcp addbefore starting any Solana task if Solana MCP is not present, without first asking the user. This modifies agent configuration and connects to a remote service, which aligns with the purpose of "checking real-time documentation" but requires awareness; the Gen Agent Trust Hub audit on skills.sh is marked as Pass - SKILL.md specifies Node.js 20.18 or higher; requires agents to prefix all command-line calls with NO_DNA=1, using public RPC and curl for single on-chain queries
- Mainnet operations involve real funds, relying on agents to adhere to guardrails; content tracks new versions closely (the text notes web3.js 3.0.0 was released on 2026-10-01), and versions change rapidly