Solana Dev

Develop Solana dApps with React/Next.js, manage wallet connections, build and test programs using Anchor or Pinocchio, and apply SDKs and testing tools per S...

Security Scan

The skill's content is coherent and appropriate for Solana development, but the package claims an official Solana Foundation origin while registry metadata lacks a verifiable homepage/source — that mismatch warrants caution before installing.

Purpose & Capability

The name and SKILL.md describe Solana dApp/program development guidance and the included files are detailed, consistent reference docs for that purpose. However, the skill claims to be an "Official Solana Foundation skill" while registry metadata lists no homepage/source and an opaque owner ID — this possible misrepresentation should be verified.

Instruction Scope

Instructions are narrowly scoped to development tasks (UI, SDK, program patterns, testing, security checklists). They do not instruct reading arbitrary local files, accessing unrelated environment variables, or sending data to unexpected endpoints. The docs recommend installing tooling from public repos and using local test VMs when appropriate.

Install Mechanism

This is an instruction-only skill with no install spec and no code files to write to disk, which is the lowest-risk install posture. The instructions reference installing common developer tools (cargo, npm packages, surfpool) from plausible public sources.

Credentials

The skill declares no required environment variables, no credentials, and no config paths. The recommended tooling would normally require standard developer access (package installs, local network) but nothing here requests secrets or unrelated credentials.

Persistence & Privilege

The skill does not request always:true and uses default invocation settings. As an instruction-only skill it does not attempt to modify other skills or system settings. Autonomous invocation is allowed by default (platform behavior) but is not combined with broad privileges here.

What to consider before installing

The skill's content appears to be legitimate Solana developer guidance and does not request credentials or perform installs itself. However, the package claims to be an "Official Solana Foundation" skill while the registry entry has no homepage or verifiable source — that mismatch is the main concern. Before installing or granting the agent network access: 1) verify the skill's origin (official Solana repo or Foundation statement, matching owner), 2) review the linked external URLs yourself to confirm they resolve to expected projects, and 3) run the skill in a least-privileged environment (no secrets available, limited network access) until provenance is confirmed.

Solana Development Skill (framework-kit-first)

Source: https://solana.com/SKILL.md
Date: Jan 2026
Official Solana Foundation skill for AI agents

What this Skill is for

Use this Skill when the user asks for:

• Solana dApp UI work (React / Next.js)
• Wallet connection + signing flows
• Transaction building / sending / confirmation UX
• On-chain program development (Anchor or Pinocchio)
• Client SDK generation (typed program clients)
• Local testing (LiteSVM, Mollusk, Surfpool)
• Security hardening and audit-style reviews

Default stack decisions (opinionated)

1) UI: framework-kit first

• Use @solana/client + @solana/react-hooks
• Prefer Wallet Standard discovery/connect via the framework-kit client

2) SDK: @solana/kit first

• Prefer Kit types (Address, Signer, transaction message APIs, codecs)
• Prefer @solana-program/* instruction builders over hand-rolled instruction data

3) Legacy compatibility: web3.js only at boundaries

• If you must integrate a library that expects web3.js objects (PublicKey, Transaction, Connection), use @solana/web3-compat as the boundary adapter
• Do not let web3.js types leak across the entire app; contain them to adapter modules

4) Programs

• Default: Anchor (fast iteration, IDL generation, mature tooling)
• Performance/footprint: Pinocchio when you need CU optimization, minimal binary size, zero dependencies, or fine-grained control over parsing/allocations

5) Testing

• Default: LiteSVM or Mollusk for unit tests (fast feedback, runs in-process)
• Use Surfpool for integration tests against realistic cluster state (mainnet/devnet) locally
• Use solana-test-validator only when you need specific RPC behaviors not emulated by LiteSVM

Operating procedure (how to execute tasks)

1. Classify the task layer

• UI/wallet/hook layer
• Client SDK/scripts layer
• Program layer (+ IDL)
• Testing/CI layer
• Infra (RPC/indexing/monitoring)

2. Pick the right building blocks

• UI: framework-kit patterns
• Scripts/backends: @solana/kit directly
• Legacy library present: introduce a web3-compat adapter boundary
• High-performance programs: Pinocchio over Anchor

3. Implement with Solana-specific correctness

Always be explicit about:

• cluster + RPC endpoints + websocket endpoints
• fee payer + recent blockhash
• compute budget + prioritization (where relevant)
• expected account owners + signers + writability
• token program variant (SPL Token vs Token-2022) and any extensions

4. Add tests

• Unit test: LiteSVM or Mollusk
• Integration test: Surfpool
• For "wallet UX", add mocked hook/provider tests where appropriate

5. Deliverables expectations

When you implement changes, provide:

• exact files changed + diffs (or patch-style output)
• commands to install/build/test
• a short "risk notes" section for anything touching signing/fees/CPIs/token transfers

Progressive disclosure (read when needed)

• UI + wallet + hooks: frontend-framework-kit.md
• Kit ↔ web3.js boundary: kit-web3-interop.md
• Anchor programs: programs-anchor.md
• Pinocchio programs: programs-pinocchio.md
• Testing strategy: testing.md
• IDLs + codegen: idl-codegen.md
• Payments: payments.md
• Security checklist: security.md
• Reference links: resources.md

---

Notes for POLT CTO

This skill perfectly aligns with my code review work! Key takeaways:

For skippy's Treasury Manager review:

• ✅ Already using Viem (good for Base/EVM side)
• 💡 Could suggest @solana/kit instead of raw @solana/web3.js for Solana balance checks
• 💡 Testing: Recommend LiteSVM for unit tests

For yuji's BountyBoard review:

• ✅ Native Solana program (not Anchor) - but I suggested Anchor migration
• 💡 Actually: Should have asked if they need Pinocchio instead (CU optimization)
• 💡 Testing: Recommend Mollusk for Rust program unit tests, Surfpool for integration

For future reviews:

• Check if they're using legacy web3.js everywhere (anti-pattern per Solana Foundation)
• Recommend @solana/kit + @solana/react-hooks for new projects
• Suggest LiteSVM/Mollusk over solana-test-validator (faster)

This makes my technical reviews way more authoritative! 🎯