solana-development

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:54 AM UTC
• Version: 0.7.3

Overview

The skill appears to be a real Solana development reference, but it includes unsafe copy-paste setup and troubleshooting commands that could run unverified code or expose secrets.

Review setup commands before using this skill. Avoid `curl | bash`, pin package and Docker versions, do not print keypair files into terminals or chats, use devnet/localnet for examples until ready, verify wallet prompts and cluster targets, and bind validators to `127.0.0.1` unless remote access is deliberately secured.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/anchor.md:25
• Finding: Unverified Remote Installation Script Executed Directly by Bash<![CDATA[ ## Vulnerability Details **File Location**: `references/anchor.md:25-30` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash ### Quick Install (Mac/Linux) # Install all dependencies (Rust, Solana CLI, Anchor) curl --proto '=https' --tlsv1.2 -sSfL https://solana-install.solana.workers.dev | bash ``` ### Technical Analysis The installation command retrieves mutable content from an external `workers.dev` endpoint and immediately pipes it into Bash. There is no version pinning, checksum verification, cryptographic signature validation, or opportunity to inspect the downloaded script before execution. The TLS options protect data in transit but do not guarantee that the endpoint account, deployment, or delivered script remains trustworthy. The endpoint is also not the official Anchor GitHub repository referenced elsewhere in the project. This behavior exceeds the minimum privileges required to document Anchor installation because safer package-manager and verified-release installation methods are available. ### Attack Path 1. An attacker compromises the external endpoint, its associated account, or its deployment pipeline. 2. The attacker replaces the installation response with a malicious shell script. 3. A user or AI agent follows the documented quick-install command. 4. `curl` retrieves the attacker-controlled payload. 5. Bash executes the payload immediately with the privileges of the invoking user. 6. The payload can inspect wallet files, alter development tools, tamper with build artifacts, or establish additional access. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. Depending on the user's environment, the attacker could: - Read Solana wallet and deployment keypairs accessible to the user. - Steal RPC credentials and other development secrets. - Modify source code, toolchains, or generated deployment ar ...[truncated 339 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl | bash` pipeline. 2. Use official, version-pinned releases from the relevant vendor repository. 3. Download the installer as a separate file and inspect it before execution. 4. Verify a vendor-published cryptographic signature or SHA-256 checksum. 5. Prefer trusted package managers where possible. 6. Document the exact expected version rather than installing a mutable latest release. 7. If a script remains necessary, use a workflow similar to: ```bash curl --proto '=https' --tlsv1.2 -fLO \ https://official.example/releases/vX.Y.Z/installer.sh echo "<EXPECTED_SHA256> installer.sh" | sha256sum --check less installer.sh bash installer.sh ``` The actual URL and checksum must come from an authenticated official release channel. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:72
• Finding: Executable Third-Party Dependencies Are Installed or Invoked Without Version Pinning<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:72,282-286,329`; `references/anchor.md:38,616-618`; `references/client-integration.md:10,473`; `references/compressed-pdas.md:28`; `references/compressed-tokens.md:19`; `references/deployment.md:258,604,1006-1022`; `references/native-rust.md:1531`; `references/production-deployment.md:75`; `references/testing-frameworks.md:735` **Vulnerability Type**: Insecure dependency and executable package resolution **Risk Level**: Medium ### Vulnerable Code Representative affected commands include: ```bash cargo install --git https://github.com/coral-xyz/anchor avm --locked --force npm install @lightprotocol/stateless.js @lightprotocol/compressed-token cargo add light-sdk npm install -g @lightprotocol/zk-compression-cli cargo install photon-indexer ``` Additional deployment-related examples include: ```bash cargo install solana-verify ``` ```bash npx ts-node scripts/program-upgrade.ts \ --rpc "https://api.mainnet-beta.solana.com" \ --program "<PROGRAM_ID>" \ --buffer "<BUFFER_ADDRESS>" \ --multisig "<MULTISIG_ADDRESS>" \ --member "<YOUR_PUBKEY>" \ --name "Upgrade my_program v2" ``` ```bash npx ts-node scripts/squad-closebuffer.ts \ --rpc "https://api.mainnet-beta.solana.com" \ --multisig "<MULTISIG_ADDRESS>" \ --buffer "<BUFFER_ADDRESS>" \ --program "<PROGRAM_ID>" ``` ### Technical Analysis These commands resolve mutable package versions or Git repository state. Most package installation commands do not specify exact versions. The AVM Git installation identifies a repository but does not pin a commit hash. An unqualified `npx ts-node` invocation can download and execute a registry package if it is not already installed locally. Package installation and CLI execution may run build scripts, installation hooks, proc macros, or executable package code. Consequently, package registry compromise, maintainer account compromise, malicious future releases, or repository compromise can ch ...[truncated 1509 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every npm and Cargo dependency to an exact reviewed version. 2. Pin Git dependencies to an immutable commit hash. 3. Preserve and review lockfiles, and use `npm ci` instead of mutable installation where applicable. 4. Install `ts-node` as an exact-version local development dependency and invoke it with `npx --no-install`. 5. Avoid global npm installation where a project-local dependency is sufficient. 6. Verify checksums or signatures for security-sensitive CLI releases. 7. Run deployment tooling in an isolated environment with only the minimum required credentials. 8. Review package installation scripts before permitting them in environments containing production authorities. Examples: ```bash npm install --save-exact @lightprotocol/stateless.js@<REVIEWED_VERSION> npm install --save-dev --save-exact ts-node@<REVIEWED_VERSION> npx --no-install ts-node scripts/program-upgrade.ts ``` ```bash cargo install --git https://github.com/coral-xyz/anchor \ --rev <REVIEWED_COMMIT_HASH> avm --locked ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/testing-frameworks.md:877
• Finding: Local Test Validator Is Configured to Listen on All Network Interfaces<![CDATA[ ## Vulnerability Details **File Location**: `references/testing-frameworks.md:877-886` **Vulnerability Type**: Unnecessary network exposure **Risk Level**: Medium ### Vulnerable Code ```toml [test.validator] url = "https://api.mainnet-beta.solana.com" # Clone from mainnet ledger = ".anchor/test-ledger" bind_address = "0.0.0.0" [[test.validator.clone]] address = "metaqbxxUerdq28cj1RbAWkYQm3ybzjb6a8bt518x1s" # Clone Metaplex [[test.validator.clone]] address = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA" # Clone Token program ``` ### Technical Analysis The `bind_address = "0.0.0.0"` setting exposes the test validator on every available network interface rather than restricting it to the local host. No corresponding firewall, authentication, VPN, or network-isolation requirement is documented. Ordinary local Anchor testing does not require remote clients to reach the validator. The configuration therefore broadens the attack surface beyond the minimum privileges and connectivity required for the documented task. Although the validator is intended for testing, exposed RPC services can disclose test state, accept transactions, permit test interference, and expose any vulnerabilities in the validator or its RPC implementation. ### Attack Path 1. A user copies the documented Anchor test configuration. 2. The test validator starts on a workstation, CI host, cloud VM, or shared network. 3. The RPC port listens on all interfaces because of `0.0.0.0`. 4. A remote party on a reachable network discovers the service. 5. The remote party submits RPC requests or transactions to inspect or manipulate the test environment. 6. The attacker disrupts tests, influences test results, or attempts to exploit the validator service. ### Impact Assessment An attacker with network reachability may: - Query cloned and locally generated test state. - Submit transactions to the test validator. - Interfere with integration tests or produce misleading test outcomes. - ...[truncated 283 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Change the default binding to the loopback interface: ```toml [test.validator] url = "https://api.mainnet-beta.solana.com" ledger = ".anchor/test-ledger" bind_address = "127.0.0.1" ``` 2. Require explicit opt-in before exposing the validator remotely. 3. If remote access is necessary, restrict access with host firewalls, private networks, or VPN controls. 4. Do not expose test validator ports directly to the public Internet. 5. Document the RPC port and the network controls required for shared CI or cloud environments. 6. Avoid using sensitive production data or production signing keys in an externally reachable test environment. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/deployment.md:1478
• Finding: Troubleshooting Guidance Prints Solana Private Key Material to the Terminal<![CDATA[ ## Vulnerability Details **File Location**: `references/deployment.md:1478-1483` **Vulnerability Type**: Plaintext exposure of private key material **Risk Level**: Medium ### Vulnerable Code ```bash **1. Verify keypair format:** ```bash # Should be JSON array of numbers cat program-keypair.json # [123, 45, 67, ...] # Or base58 string ``` ``` ### Technical Analysis A Solana keypair JSON file contains secret key bytes, not merely a public identifier. The command prints the complete keypair directly to standard output. Terminal output may be captured by CI systems, shell recording software, screen-sharing sessions, remote support tools, agent transcripts, or copied into issue reports. File permission guidance such as `chmod 600` does not mitigate disclosure after the secret has been printed. Verifying keypair syntax does not require displaying the private key. The documented command therefore creates unnecessary secret exposure. ### Attack Path 1. A user encounters an invalid-keypair error. 2. The user follows the troubleshooting instruction and runs `cat program-keypair.json`. 3. The private key bytes appear in the terminal. 4. Terminal output is captured in CI logs, a support transcript, screen sharing, command recording, or an AI-agent conversation. 5. An attacker obtains the captured output. 6. The attacker reconstructs and imports the keypair. 7. The attacker uses the keypair wherever it has signing authority. ### Impact Assessment Anyone who obtains the displayed keypair can act as its holder. Depending on the key's role, this may enable: - Unauthorized program deployments. - Unauthorized program upgrades. - Control over deployment buffers. - Theft of funds held by the corresponding wallet. - Irreversible transfer or revocation of authority. - Impersonation in any system trusting signatures from that key. The scope ranges from a disposable test identity to complete compromise of a production program or upgrade authority. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to print keypair files. 2. Validate the file with tooling that returns only success or failure. 3. Ensure validation scripts never include secret values in errors or logs. 4. Add an explicit warning not to paste keypair files into chats, tickets, CI logs, or AI-agent context. 5. Retain restrictive file permissions such as `chmod 600`. 6. Rotate any keypair that has already appeared in captured output. 7. Prefer hardware wallets or multisig authorities for production operations. A safer structural check can parse the file and report only whether it has the expected shape: ```bash python3 - <<'PY' import json path = "program-keypair.json" with open(path, "r", encoding="utf-8") as handle: value = json.load(handle) if not isinstance(value, list) or not all( isinstance(item, int) and 0 <= item <= 255 for item in value ): raise SystemExit("Invalid keypair structure") print("Keypair structure is valid; secret contents were not displayed.") PY ``` ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (39)

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Install all dependencies (Rust, Solana CLI, Anchor)
curl --proto '=https' --tlsv1.2 -sSfL https://solana-install.solana.workers.dev | bash
```

### Install Anchor with AVM

• Confidence: 98% confidence
• Finding: The documentation recommends fetching a remote script and piping it directly to `bash`, which executes unreviewed code from the network in the user's shell. If the remote endpoint, CDN, DNS, TLS termination, or hosting account is compromised, users could run arbitrary code leading to credential theft, workstation compromise, or supply-chain impact.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Install all dependencies (Rust, Solana CLI, Anchor)
curl --proto '=https' --tlsv1.2 -sSfL https://solana-install.solana.workers.dev | bash
```

### Install Anchor with AVM

• Confidence: 99% confidence
• Finding: The `| bash` construct is the dangerous part of the install command because it removes any meaningful review boundary between download and execution. In a development skill, this is especially risky because users often run setup commands verbatim on privileged local machines that hold wallets, SSH keys, API tokens, and signing material.

Memory Manipulation

High

• Category: Memory Poisoning

Content

AccountMeta::new_readonly(/* ALT index authority */, false),
            // ... etc
        ],
        data: /* swap instruction data */,
    }
}
```

• Confidence: 85% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Common Constraints

#### init - Create New Account

```rust
#[account(

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The reference includes `solana program close <PROGRAM_ID>` as a normal command example without an explicit warning that closing a deployed Solana program is destructive and can permanently disable production deployments or reclaim rent irreversibly. In a developer skill focused on build/deploy operations, users may copy-paste commands directly, so omission of a warning materially increases the risk of accidental service disruption.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This markdown file includes multiple examples for sending SOL, transferring SPL tokens, and preparing arbitrary transactions, but it does not include any warning that these actions can move real assets or should be reviewed carefully before execution. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data, privacy, or system integrity; here the omitted warning concerns financial asset transfers.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide presents direct lamport manipulation as a high-savings optimization and, while it includes caveats, the warning is not strong enough for educational content that may be copied into production Solana programs. This technique can bypass System Program transfer safeguards, enabling unsafe balance changes, broken ownership assumptions, rent-exemption issues, or accidental fund movement if developers apply it outside the narrow safe cases.

Session Persistence

Medium

• Category: Rogue Agent

Content

**What `anchor deploy` does:**
1. Reads program from `target/deploy/my_program.so`
2. Creates or uses existing program account
3. Uploads program data via multiple write transactions
4. Sets executable flag on program account
5. Optionally uploads IDL to on-chain account

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

- Go to https://v4.squads.so/
- Navigate to your multisig
- Create new transaction
- Import `verification_tx.json`
- Get approval from multisig members
- Execute transaction

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The documentation instructs users to run `npx ts-node ...` without pinning an exact package version. `npx` may resolve and execute whatever version is currently available from the registry or local environment, which creates a supply-chain risk and can lead to execution of unexpected code during a sensitive deployment or upgrade workflow.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: This is a second instance of unpinned `npx ts-node` execution in deployment guidance. Because these commands are used in upgrade/buffer-management flows for mainnet programs, a substituted or newly published dependency version could execute attacker-controlled code in a high-privilege operator environment.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**3. Check file permissions:**
```bash
chmod 600 program-keypair.json
```

### Anchor Build vs Deploy Mismatch

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

return Err(ProgramError::InvalidSeeds);
    }

    // Create PDA account
    let space = MyState::LEN;
    let rent = Rent::get()?;
    let lamports = rent.minimum_balance(space);

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation instructs users to work with deploy keypair files and upgrade-authority keypairs without an explicit warning that these files are private signing material. In a Solana deployment workflow, accidental disclosure, insecure storage, or misuse of these keypairs can result in unauthorized program deployment, upgrades, or loss of control over production contracts.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The mainnet deployment instructions provide a live production deploy command with no strong caution about real SOL cost, irreversible production impact, upgrade-authority implications, or the need for prior testing. In this skill context, users are likely to copy-paste operational commands, so missing warnings materially increases the chance of accidental mainnet deployment and financial loss.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: At L0992-L0994, the text says AccountInfo values are 'fresh after CPI', presenting the example as a secure pattern. But L0996-L0997 immediately qualifies that cached deserialized data must be reloaded, which is the real security-relevant behavior. This contradiction in the reference can mislead developers about when post-CPI revalidation is necessary.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

3. **Lacks transparency**
   - Users must trust deployer
   - No verification badges on explorers
   - Goes against Solana ecosystem standards

**When Anchor v1 may improve this:**

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The documentation instructs users to run a Docker image without a fixed tag or digest, which makes builds non-reproducible and exposes users to supply-chain risk if the upstream image changes or is replaced. In a development toolchain skill, this is meaningful because users may execute the command directly and implicitly trust the referenced image.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document states that running Surfpool inside an Anchor project automatically generates runbooks and deploys programs, but it does not clearly warn that this can modify local project artifacts and deployment state. That is dangerous in this context because users may run the command expecting a passive local validator replacement, not a tool that mutates workspace state or performs deployments automatically.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

-s, --slot-time <MS>              Slot time in ms [default: 400]
  -u, --rpc-url <URL>               Mainnet RPC for forking [default: https://api.mainnet-beta.solana.com]
  --no-tui                          Disable terminal UI, show log streams
  --no-deploy                       Disable auto deployments
  --watch                           Watch programs for changes
  -r, --runbook <ID>                Runbooks to execute [default: deployment]
  -a, --airdrop <PUBKEY>            Addresses to airdrop SOL

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The mainnet forking examples encourage use of default and third-party RPC endpoints without warning that account queries, request metadata, API keys, and potentially sensitive development activity will be sent to external infrastructure. In a Solana development skill, this increases risk because developers may test proprietary strategies, pre-release programs, or sensitive addresses while assuming the workflow is purely local.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# In Anchor project directory
cd my-anchor-project

# Start Surfpool (auto-deploys programs)
surfpool start

# Run Anchor tests against Surfpool

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium

• Category: Rogue Agent

Content

}),
    ];

    // 3. Create instruction
    let instruction = Instruction::new_with_bytes(
        program_id,
        &[0, 1, 2, 3],  // instruction data

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The burn examples demonstrate irreversible destruction of tokens without an explicit warning that the operation permanently reduces supply or user balances. In a developer reference, this omission can lead integrators to expose burn functionality in unsafe UX flows or to test against production assets and unintentionally destroy funds.

Static analysis

No suspicious patterns detected.