Zeroization Audit
trailofbits/skills
Finds sensitive data that C, C++ or Rust code never wipes from memory, including wipes the compiler optimizes away, using source, assembly and control-flow analysis.
Defense-in-depth security across Rust, TypeScript, and Bash for the Pump SDK — cryptographic key handling, memory zeroization, secure file I/O, input validation, privilege management, dependency…
Install Pump Security
$ npx skills add nirholas/pump-fun-sdk --skill pump-security -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install nirholas/pump-fun-sdk pump-security --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/nirholas/pump-fun-sdk.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/pump-security .claude/skills/pump-security && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "pump-security" agent skill from https://github.com/nirholas/pump-fun-sdk/tree/main/skills/pump-security into .claude/skills/pump-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pump-security", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/nirholas/pump-fun-sdk/tree/main/skills/pump-securityType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add nirholas/pump-fun-sdk --skill pump-security -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install nirholas/pump-fun-sdk pump-security --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/nirholas/pump-fun-sdk.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/pump-security .agents/skills/pump-security && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "pump-security" agent skill from https://github.com/nirholas/pump-fun-sdk/tree/main/skills/pump-security into .agents/skills/pump-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pump-security", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add nirholas/pump-fun-sdk --skill pump-security -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install nirholas/pump-fun-sdk pump-security --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/nirholas/pump-fun-sdk.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/pump-security .cursor/skills/pump-security && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "pump-security" agent skill from https://github.com/nirholas/pump-fun-sdk/tree/main/skills/pump-security into .cursor/skills/pump-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pump-security", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/nirholas/pump-fun-sdk.git --path skills/pump-security--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add nirholas/pump-fun-sdk --skill pump-security -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install nirholas/pump-fun-sdk pump-security --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/nirholas/pump-fun-sdk.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/pump-security .gemini/skills/pump-security && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "pump-security" agent skill from https://github.com/nirholas/pump-fun-sdk/tree/main/skills/pump-security into .gemini/skills/pump-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pump-security", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install nirholas/pump-fun-sdk pump-securityInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add nirholas/pump-fun-sdk --skill pump-security -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/nirholas/pump-fun-sdk.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/pump-security .github/skills/pump-security && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "pump-security" agent skill from https://github.com/nirholas/pump-fun-sdk/tree/main/skills/pump-security into .github/skills/pump-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pump-security", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add nirholas/pump-fun-sdk --skill pump-security -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install nirholas/pump-fun-sdk pump-security --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/nirholas/pump-fun-sdk.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/pump-security .opencode/skills/pump-security && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "pump-security" agent skill from https://github.com/nirholas/pump-fun-sdk/tree/main/skills/pump-security into .opencode/skills/pump-security/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pump-security", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
pump-security- GitHub stars
- 133
- Token cost
- ~892 tokens
- SKILL.md length
- 349 words
- Files
- 1
- Skills in repo
- 18
- Repo updated
- First seen
- Licence
- Custom licence
At a glance
Defense-in-depth security across Rust, TypeScript, and Bash for the Pump SDK — cryptographic key handling, memory zeroization, secure file I/O, input validation, privilege management, dependency…
- Works in 5 steps: Re-derive public key from secret key → Compare derived key with stored public key → Sign a test message with the keypair → …
- Tasks that involve Cryptography
- SKILL.md covers Memory Zeroization, RNG Quality, Keypair Integrity Verification and Secure File I/O, plus 5 more sections
- Calls cargo and npm
What it does
Pump Security is an agent skill from nirholas/pump-fun-sdk. Defense-in-depth security across Rust, TypeScript, and Bash for the Pump SDK — cryptographic key handling, memory zeroization, secure file I/O, input validation, privilege management, dependency auditing, and a 60+ item security checklist.
Its SKILL.md is about 890 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Cryptography, Secure coding and Security review. It works with Rust, TypeScript, Bash and Solana. The repository describes itself as: Token creation launching, bonding curve trading, AMM migration, tiered fees, creator fee sharing, vanity keygen, MCP server, Telegram bot & live dashboards.
When your agent uses it
- Tasks that involve Cryptography
- Tasks that involve Secure coding
- Tasks that involve Security review
Example prompts
- “/pump-security”
Requirements
- Node.js
Workflow steps
5 steps, taken from the first numbered list in SKILL.md.
- Re-derive public key from secret key
- Compare derived key with stored public key
- Sign a test message with the keypair
- Verify the signature with the public key
- Validate Base58 encoding roundtrip
What it can do on your machine
Read from SKILL.md and the folder at commit fcfc876. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
cargonpm
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use npm, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Pump Security loads about 892 tokens when it runs. Until then it costs about 63 tokens; SKILL.md has 349 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
Its licence (Custom licence) doesn't allow us to republish the file, so here is its outline and opening line. It has 349 words (~892 tokens).
“Defense-in-depth security across Rust, TypeScript, and Bash: key handling, memory zeroization, secure file I/O, input validation, privilege management, and dependency auditing.”
- name
- pump-security
Files
Just SKILL.md in skills/pump-security of nirholas/pump-fun-sdk.
Open the folder on GitHubat commit fcfc876
Compare with similar skills
Pump Security next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Pump Security this skillnirholas/pump-fun-sdk | 133 | — | ~892 | Automated safety check: Pass | Custom licence | |
| Zeroization Audittrailofbits/skills | 7.4k | 4 repos | ~5.9k | Automated safety check: Notes | CC-BY-SA-4.0 | |
| CodeQL Security Scantrailofbits/skills | 7.4k | — | ~4.6k | Automated safety check: Notes | CC-BY-SA-4.0 | |
| Security AuditTheDecipherist/claude-code-mastery | 550 | — | ~1.3k | Automated safety check: Notes | MIT | |
| Security Reviewdeadlock-mod-manager/deadlock-mod-manager | 473 | — | ~1.8k | Automated safety check: Pass | CC-BY-SA-4.0 | |
| Sharp Edges Analysistrailofbits/skills | 7.4k | 3 repos | ~3k | Automated safety check: Pass | CC-BY-SA-4.0 |
Similar skills
- Official
- Official
CodeQL Security Scan
trailofbits/skills
Scans a codebase for vulnerabilities with CodeQL's data flow and taint tracking in run-all or important-only modes, including data extensions for project-specific sources and sinks.
Security Audit
TheDecipherist/claude-code-mastery
Checks a codebase for hardcoded secrets, vulnerable dependencies, weak input handling, weak authentication and unsafe transport settings before deployment or merge.
Security Review
deadlock-mod-manager/deadlock-mod-manager
Security code review for Tauri/Rust/TypeScript desktop apps and Hono/oRPC APIs.
- Official
Sharp Edges Analysis
trailofbits/skills
Reviews APIs, configuration schemas and library interfaces for footguns, the designs where the easy path leads to insecure use, using a four-phase analysis.
- Official
Code Security
semgrep/skills
Security guidelines for writing secure code. An agent skill from semgrep/skills.
More from nirholas/pump-fun-sdk
All 18 skills in this repoPump AI Agents
nirholas/pump-fun-sdk
AI agent integration layer for the Pump SDK — agent instruction files, .well-known discovery, LLM context documents, 15+ skill files, MCP server prompts, and terminal management rules for GitHub…
Pump Admin Ops
nirholas/pump-fun-sdk
Admin and authority operations for the Pump protocol — set coin creator, update token incentives, set IDL authority, claim cashback, Mayhem mode, and BothPrograms cross-program admin instructions.
Pump Bonding Curve
nirholas/pump-fun-sdk
Constant-product AMM bonding curve math for Pump token pricing — buy/sell quoting, fee-aware calculations, market cap computation, tiered fees, ceiling division, virtual vs real reserves, and…
Pump Build Release
nirholas/pump-fun-sdk
Build and release pipeline for the Pump SDK — tsup TypeScript builds, Cargo release profiles, semantic release with commitizen, npm publishing, linting, Makefile targets, Vercel deployment, and MCP…
Pump Claims Readonly
nirholas/pump-fun-sdk
Read-only query methods for PumpFun claims — unclaimed token rewards, creator vault balances, volume accumulators, distributable fees, and current-day token previews across Pump and PumpAMM programs.
Pump Fee Sharing
nirholas/pump-fun-sdk
Configure and distribute creator fees to multiple shareholders using the PumpFees program with BPS-based share allocation, admin management, and cross-program fee consolidation for graduated tokens.
Related
Works with
Categories
Questions about Pump Security
What does Pump Security do?
Defense-in-depth security across Rust, TypeScript, and Bash for the Pump SDK — cryptographic key handling, memory zeroization, secure file I/O, input validation, privilege management, dependency…. Pump Security is an agent skill from nirholas/pump-fun-sdk. Defense-in-depth security across Rust, TypeScript, and Bash for the Pump SDK — cryptographic key handling, memory zeroization, secure file I/O, input validation, privilege management, dependency auditing, and a 60+ item security checklist.
When should I use Pump Security?
Pump Security fits situations like: tasks that involve Cryptography; tasks that involve Secure coding; tasks that involve Security review.
How do I install Pump Security in Claude Code?
Run `npx skills add nirholas/pump-fun-sdk --skill pump-security -a claude-code`. Or copy the skill folder (skills/pump-security in nirholas/pump-fun-sdk) into .claude/skills/pump-security in your project. Claude Code loads it when a task matches its description.
How do I install Pump Security in Codex?
Run `npx skills add nirholas/pump-fun-sdk --skill pump-security -a codex`. Or copy the skill folder (skills/pump-security in nirholas/pump-fun-sdk) into .agents/skills/pump-security in your project. Codex loads it when a task matches its description.
Can I use Pump Security in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add nirholas/pump-fun-sdk --skill pump-security -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/pump-security, .gemini/skills/pump-security, .github/skills/pump-security and .opencode/skills/pump-security in your project.
What does Pump Security need to run?
Going by SKILL.md and its folder, Pump Security needs the command-line tools its instructions call (cargo and npm). Our summary lists: Node.js.
Does Pump Security access the network?
SKILL.md contains no URLs. Its commands use npm, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Is Pump Security safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Pump Security use?
Pump Security has a licence file (the repository's licence) that doesn't match a standard licence. Read it on GitHub before reusing the skill.
How many tokens does Pump Security use?
About 892 tokens (SKILL.md is roughly 3.6k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Pump Security?
Skills that share tags, products or a category with Pump Security: Zeroization Audit (trailofbits/skills, 7.4k stars), CodeQL Security Scan (trailofbits/skills, 7.4k stars), Security Audit (TheDecipherist/claude-code-mastery, 550 stars) and Security Review (deadlock-mod-manager/deadlock-mod-manager, 473 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Pump Security?
nirholas (a GitHub user) maintains it in nirholas/pump-fun-sdk, which has 133 GitHub stars. The repository holds 18 skills in this directory. The repository was last updated on September 18, 2026.
Source: nirholas/pump-fun-sdk on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.