Cabin Sol

PassAudited by ClawScan on May 1, 2026.

Overview

Cabin Sol is a coherent Solana tutorial skill, with user-directed blockchain deployment and third-party install examples that users should review before running.

This skill appears safe to install as a tutorial/reference skill. Before running any commands from it, use a test wallet, prefer localnet or devnet, verify whether commands install third-party software, and double-check any mainnet deployment or transaction that could spend SOL or create permanent on-chain state.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

If copied without review, these commands could deploy to Solana mainnet and spend real SOL.

Why it was flagged

The skill documents a mainnet deployment workflow that can spend real funds and publish a program. This is purpose-aligned for a Solana development tutor and is disclosed, but users should intentionally confirm network, wallet, and costs before running it.

Skill content

# Mainnet (costs ~2-5 SOL)
solana config set --url mainnet-beta
anchor deploy --provider.cluster mainnet

Recommendation

Use devnet or localnet while learning, verify the active Solana cluster and wallet, and only deploy to mainnet after reviewing cost and program behavior.

NoteMedium Confidence

ASI03: Identity and Privilege Abuse

What this means

Transactions may be signed with the user's configured Solana wallet or development keypair.

Why it was flagged

The examples use Anchor providers and signers to submit transactions. This is expected for Solana development, but it means user wallet authority may be involved when examples are adapted or run.

Skill content

const provider = anchor.AnchorProvider.env();
anchor.setProvider(provider);
...
.signers([account])
.rpc();

Recommendation

Keep learning wallets separate from funded wallets, check which keypair/provider is active, and avoid using mainnet credentials for tests.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Running the command executes a script fetched from the internet on the user's machine.

Why it was flagged

The challenge documentation includes a user-directed remote installer command for the Metaplex Sugar CLI. This fits the NFT tutorial purpose, but remote installer provenance should be checked before execution.

Skill content

bash <(curl -sSf https://sugar.metaplex.com/install.sh)

Recommendation

Inspect remote install scripts or use official package-manager instructions before running them, especially on machines with wallets or private keys.