Solana Sniper Architect

Generates production-ready Python Solana trading bots using Jupiter v6 API and DexScreener data with priority fees and secure key management.

Security Scan

The skill's runtime instructions clearly build Solana trading bots and require handling a private key, but the package metadata omits any required credentials and gives no safety guidance — this mismatch and the high-impact actions the skill enables are concerning.

Purpose & Capability

The SKILL.md describes a Solana high-frequency trading bot generator (Jupiter v6 + DexScreener + solders) which is coherent with the skill name. However, the registry metadata provides no description and declares no required environment variables or credentials even though the instructions demand a PRIVATE_KEY environment variable and .env usage. That metadata/instruction mismatch is unexpected and reduces transparency.

Instruction Scope

The instructions explicitly require creating production-ready scripts that sign and submit transactions (priority fees via the solders library) and instruct the agent to read os.getenv('PRIVATE_KEY') and include a .env template. Those runtime actions are high-impact (can move funds) and the SKILL.md gives no guidance to prefer secure signing (hardware wallets, remote signing, or manual signing) or to limit testing to dev/testnet. The instructions also require polling DexScreener and calling Jupiter APIs (external network calls), which is consistent with purpose but broad in scope for an instruction-only skill.

Install Mechanism

This is an instruction-only skill with no install spec and no code files, which minimizes immediate supply-chain risk. It will produce Python scripts and a requirements.txt at runtime but does not itself download or install packages.

Credentials

The SKILL.md mandates using PRIVATE_KEY via os.getenv and a .env template, but the skill metadata lists no required env vars or primary credential. Requesting a private key for signing is expected for a trading bot, but the omission from requires.env is an incoherence. Also, advice to put keys in .env (loaded by python-dotenv) can encourage insecure local storage; no safer alternatives (hardware/key management, ephemeral keys, testnet) are suggested.

Persistence & Privilege

always is false and there is no install behavior or persistent privileges requested. The skill can be invoked autonomously (disable-model-invocation: false), which is normal for skills and not by itself a red flag; it does not request persistent presence or modify other skills.

What to consider before installing

This skill will generate scripts that sign and submit Solana transactions and instruct the agent to use a PRIVATE_KEY from environment/.env. Before using: (1) do not give a real mainnet private key — prefer testnet or a disposable wallet; (2) prefer hardware wallets, remote signing, or constructing unsigned transactions for manual signing rather than storing private keys in plaintext .env files; (3) ask the author to update the registry metadata to declare required env vars (e.g., PRIVATE_KEY) and to include security recommendations; (4) review any generated code carefully before running (especially transaction signing, RPC endpoints, and fee/priority logic); and (5) be aware that running HFT trading bots can cause real financial loss and has legal/ethical/market-impact implications.

Description: A specialized coding assistant that generates high-frequency Solana trading bots using Jupiter v6 and DexScreener.

Prompt

You are a Senior Solana Blockchain Developer and High-Frequency Trading Engineer.

Your goal is to write production-ready Python scripts for Solana trading bots. You must strictly adhere to the following technical constraints:

1. DEX Aggregation: ALWAYS use the Jupiter v6 API (https://quote-api.jup.ag/v6) for swapping. Never use Raydium or Orca routers directly.
2. Data Source: Use the DexScreener API for price polling and volume analysis.
3. Transaction Speed: You must implement "Priority Fees" (Micro-lamports) using the solders library to ensure transactions land during network congestion.
4. Security: Never hardcode private keys. Always use os.getenv('PRIVATE_KEY').

When asked to build a bot, provide:

• A full main.py script.
• A requirements.txt file (must include solana, solders, requests, python-dotenv).
• A .env template.

If the user asks for specific strategies (e.g., "buy if volume spikes 500%"), implement that logic in the DexScreener polling loop.