Manifest
    by Manifold
    Back to Results

    solana-dev

    Use when user asks to "build a Solana dapp", "write an Anchor program", "create a token", "debug Solana errors", "set up wallet connection", "test my Solana program", "deploy to devnet", or "explain Solana concepts" (rent, accounts, PDAs, CPIs, etc.). Also use for quick on-chain lookups via public RPC + curl — "what's the balance of <wallet>", "look up transaction <sig>", "token balance for <account>", "check this address on mainnet/devnet". End-to-end Solana development playbook covering wallet connection, Anchor/Pinocchio programs, Codama client generation, LiteSVM/Mollusk/Surfpool testing, security checklists, and JSON-RPC curl lookups against public clusters. Integrates with the Solana MCP server for live documentation search. Prefers framework-kit (@solana/client + @solana/react-hooks) for UI, wallet-standard-first connection (incl. ConnectorKit), @solana/kit for client/RPC code, and @solana/web3-compat for legacy boundaries.

    engineering›software-developmentdevops
    Rank#-1434
    solana-foundationskills.shDomain expertise83,245Last updated Oct 6, 2026, 02:56 PMskills.sh/solana-foundation/solana-dev-skill/solana-dev
    Created
    9 months ago
    Last commit
    5 days ago

    Security Findings

    No tagged releases

    SuspiciousLineage

    Repo ships no git tags and no GitHub releases — consumers cannot pin to stable, reviewable versions

    Flagged by the hosting marketplace

    SuspiciousLineage

    the skills.sh security audit flagged this skill (status=warn, risk=medium) — Snyk: W011 Third-party content exposure detected (indirect prompt injection risk). — Third-party content exposure detected (medium risk: 0.30). The Solana Developer MCP tool connects to an external URL (https://mcp.solana.com/mcp) to read live documentation and expert assistance, exposing the agent to untrusted external text.

    Remote code execution pipe

    SuspiciousAnalyzer

    Downloads and pipes to shell: curl --proto '=https' --tlsv1.2 -LsSf https://github.com/txtx/surfpool/releases/latest/download/surfpool-installer.sh | ...

    OWASP-AST01OWASP-AST02OWASP-AST06

    Remote code execution pipe

    MaliciousAnalyzer

    Downloads and pipes to shell: curl -sL https://run.surfpool.run/ | bash

    OWASP-AST01OWASP-AST02OWASP-AST06

    External binary download

    SuspiciousAnalyzer

    Prerequisite downloads from non-standard source: https://release.anza.xyz/stable/install

    OWASP-AST02

    Sensitive file access

    SuspiciousAnalyzer

    Access to sensitive file: ~/.config/solana/id.json

    OWASP-AST03

    Suspicious URL TLD2×

    SuspiciousAnalyzer

    URL with suspicious TLD .xyz: https://release.anza.xyz/v3.1.10/install

    URL with suspicious TLD .xyz: https://release.anza.xyz/stable/install

    OWASP-AST02

    Destructive command

    SuspiciousAnalyzer

    Destructive file operation: rm -rf ~/.cache/solana/

    OWASP-AST06

    Low-provenance referenced GitHub repo

    SuspiciousAnalyzer

    Referenced repo civic-io/connector-kit not found (deleted / renamed / private): https://github.com/civic-io/connector-kit

    OWASP-AST02

    Versions

    4
    • Scanned Sep 20, 2026, 06:10 AMHigh
    • Scanned Jun 1, 2026, 05:51 AMLow
    • Scanned Apr 28, 2026, 04:52 PMUnknown
    • Scanned Apr 7, 2026, 02:02 PMUnknown