Manifest
    by Manifold
    Back to Results
    Clean

    solana-dev

    Use when user asks to "build a Solana dapp", "write an Anchor program", "create a token", "debug Solana errors", "set up wallet connection", "test my Solana program", "deploy to devnet", or "explain Solana concepts" (rent, accounts, PDAs, CPIs, etc.). Also use for quick on-chain lookups via public RPC + curl — "what's the balance of <wallet>", "look up transaction <sig>", "token balance for <account>", "check this address on mainnet/devnet". End-to-end Solana development playbook covering wallet connection, Anchor/Pinocchio programs, Codama client generation, LiteSVM/Mollusk/Surfpool testing, security checklists, and JSON-RPC curl lookups against public clusters. Integrates with the Solana MCP server for live documentation search. Prefers framework-kit (@solana/client + @solana/react-hooks) for UI, wallet-standard-first connection (incl. ConnectorKit), @solana/kit for client/RPC code, and @solana/web3-compat for legacy boundaries.

    engineering›software-developmentdevops
    Publisher solana-foundation
    Sourceskills.sh
    TypeDomain expertise
    Popularity45,958
    UpdatedJul 19, 2026, 10:01 AM
    Manifest Score60
    Lineage Score90
    Safety Score60
    Ecosystem Rank1753
    Registryskills.sh/solana-foundation/solana-dev-skill/solana-dev

    Security Findings

    Remote code execution pipe

    Downloads and pipes to shell: curl --proto '=https' --tlsv1.2 -LsSf https://github.com/txtx/surfpool/releases/latest/download/surfpool-installer.sh | ...

    OWASP-AST01Learn moreOWASP-AST05Learn more

    Remote code execution pipe

    Downloads and pipes to shell: curl -sL https://run.surfpool.run/ | bash

    OWASP-AST01Learn moreOWASP-AST05Learn more

    External binary download

    Prerequisite downloads from non-standard source: https://release.anza.xyz/stable/install

    OWASP-AST02Learn more

    Sensitive file access

    Access to sensitive file: ~/.config/solana/id.json

    OWASP-AST03Learn more

    Suspicious URL TLD

    URL with suspicious TLD .xyz: https://release.anza.xyz/v3.1.10/install

    OWASP-AST02Learn more

    Suspicious URL TLD

    URL with suspicious TLD .xyz: https://release.anza.xyz/stable/install

    OWASP-AST02Learn more

    Destructive command

    Destructive file operation: rm -rf ~/.cache/solana/

    OWASP-AST06Learn more

    Low-provenance referenced GitHub repo

    Referenced repo civic-io/connector-kit not found (deleted / renamed / private): https://github.com/civic-io/connector-kit

    Low-reputation referenced domain

    Referenced domain surfnet.dev is low-reputation (registered 236 days ago (< 365d)): https://zk-edge.surfnet.dev/

    No tagged releases

    Repo ships no git tags and no GitHub releases — consumers cannot pin to stable, reviewable versions

    Flagged by the hosting marketplace

    the skills.sh security audit flagged this skill (status=warn, risk=medium) — flagged by Snyk,Runlayer

    Versions

    4
    • 60
      Clean

      Scanned Jul 19, 2026, 10:01 AM

    • 94
      Clean

      Scanned Jun 1, 2026, 05:51 AM

    • Clean

      Scanned Apr 28, 2026, 04:52 PM

    • Clean

      Scanned Apr 7, 2026, 02:02 PM