Cabin Sol
v1.2.1Solana development tutor and builder. Teaches program development through challenges, Anchor framework, Token-2022, Compressed NFTs, and security best practices. "Return to primitive computing."
⭐ 3· 2.1k·0 current·0 all-time
by@sp0oby
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description indicate an interactive Solana development/building skill (Anchor, solana-test-validator, npx projects), but the registry metadata declares no required binaries, environment variables, or credentials. Real-world usage requires tooling like node/npx/npm, Rust/cargo, solana-cli, and Anchor—these are not declared, which is an incoherence between purpose and declared requirements.
Instruction Scope
SKILL.md contains concrete shell commands (npx create-solana-dapp, anchor build/deploy, solana-test-validator, etc.) and developer guidance. It does not explicitly instruct the agent to read arbitrary system files or exfiltrate secrets, but the commands will operate on the local environment and may use local Solana keypairs/wallets implicitly. The guidance is consistent with a dev tutor, but the agent could plausibly advise running commands that access local wallets—this should be handled carefully.
Install Mechanism
There is no install spec (instruction-only) and only a small helper script (scripts/new-project.sh). No remote downloads or archive extraction are specified, which minimizes automatic code writing/execution risk. The presence of one small script means a user should inspect it before executing.
Credentials
The skill declares no required environment variables or credentials, yet the documented workflows (anchor deploy, solana CLI) normally use local keypair files and possibly environment variables (RPC endpoints, wallet locations). The manifest should explicitly document any expected credential or config usage. Absence of these declarations is disproportionate to the claimed functionality.
Persistence & Privilege
The skill does not set always:true, does not claim special persistence, and model-invocation flags are default. There is no indication it would be force-included or could autonomously run outside user invocation.
What to consider before installing
Before installing or running this skill: 1) Treat it as a development guide rather than a safe-to-run automation tool—inspect scripts/new-project.sh and any generated commands before executing them. 2) Expect to need developer tooling (node, npm/npx, Rust/cargo, solana-cli, Anchor); the skill should list those—ask the author or repository owner for a requirements list. 3) Be careful with deployments: anchor deploy and solana-test-validator will use local keypairs/wallets and RPC endpoints; never expose private keys or paste them into chat. 4) Because the source/homepage is unknown, prefer running the guide steps manually in a controlled environment (VM/container) and avoid granting any secret or credential to the skill or agent. 5) If you want to proceed, request that the skill metadata be updated to declare required binaries and any environment/config files it will use; insist on a verified source or repository URL.Like a lobster shell, security has layers — review code before you run it.
latestvk971ytje3epgab5gxx90067n9n802n4g
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🌲 Clawdis