Solana Dev

Solana skill hub

Follow further links only as needed. Paths are relative to this file.

Every install carries the core packs: solana-dev, auditor-skill, colosseum and anthropic-skills. The first three sit under ext/, which Claude Code does not auto-discover, so they cost nothing until a row here sends you into one; anthropic-skills installs top-level in skills/<name>/ and is listed every session, for about 102 tokens. The other ext/ packs are extensions: the kit pins them, and a project installs one when a task needs it. A row that links into an extension gives its install command; run it when the linked folder is missing (/update keeps what you install). The Extensions table at the end lists each one with when to use it.

The tables below answer "what do I read for this task". When the task instead suggests a pack this project has not installed — formal verification for program code, a design or animation pack for a landing page — skill-packs maps work to packs, add-ons included, and gives the rules for offering one.

When sources overlap: the program-code house rules in the project instruction file (CLAUDE.md, or AGENTS.md in --agents installs) win; a protocol's official skill wins for its own SDK (Jupiter, Metaplex, Helius, MagicBlock, Alchemy); ext/solana-dev wins for general Solana work; sendai and community skills fill gaps only.

Programs

Anchor 1.x defaults this kit uses (not all spelled out upstream): SPL transfers through token_interface::transfer_checked, account space T::DISCRIMINATOR.len() + T::INIT_SPACE, Rust LiteSVM tests under programs/<name>/tests/ (anchor test runs Surfpool).

Clients and frontend

Tokens and NFTs

DeFi, RPC and data

Other protocols from SendAI (install: bash .claude/bin/skills.sh add sendai): perps phoenix and leverage lavarage; AMMs raydium, meteora, orca; lending kamino, marginfi; LSTs sanctum; launches pumpfun; oracles pyth, switchboard; multisig squads; bridging debridge, lifi; encrypted compute arcium; ZK compression light-protocol; data birdeye, wallet-analysis; RPC carbium, quicknode; order book manifest; order flow dflow; account cleanup sol-incinerator; agents solana-agent-kit; wallets phantom-connect; scanning vulnhunter. SendAI's own jupiter, metaplex, helius and magicblock folders are older copies; the official skills above supersede them.

Security tooling

• safe-ai-skill, core (the safe-ai-skill@stbr plugin): hooks gate mainnet, value-moving and authority actions and secret reads. At session start it pins skills and ext/ submodules and moves any that drift or look unsafe into quarantine, so a missing ext/ path may be quarantined rather than uninitialized. Its ask or deny is the user's policy, so don't retry the action another way. CLI (on PATH while the plugin is enabled, else npx @stbr/safe-ai-skill): status, verify check <dir>, registry list.
• auditor-skill, core: the kit's audit pack, scope-gated so it loads only the checklists a repo needs. Programs — account validation, access control, arithmetic, CPI and PDA, state machines, economics, opsec and governance; the code around them — TypeScript, backend, frontend, supply chain, secrets, deployment, testing and formal verification, logging and incident response, privacy and change management, AI-agent surface, Rust services. Also known-vectors (138 worked attacks), framework idioms, invariant catalog, false positives, report format, and FULL-AUDIT.md for the whole-repo run. It supersedes the trailofbits, ghostsecurity, defending-code and safe-solana-builder packs the kit used to pin. Its tool-execution layer wraps Trail of Bits at vendor/trailofbits, which the installers do not fetch: the pack tests for the directory and falls back to its own grep-based discovery when it is absent, so treat that layer as absent unless you checked it. Installed packs are plain copies with no git metadata, so opting in means cloning it yourself at the commit skill-registry.json records in the entry's vendored field — and /update removes it again.
• sign-safe, extension: review a transaction at signing time rather than the program behind it. Decodes an opaque base64 transaction or message (legacy and v0 with ALTs), classifies instructions, screens recipients, and emits a SIGN / HOLD / REJECT verdict plus a verdict.json an agent can gate on. Offline and deterministic by default; --rpc adds ALT resolution, Squads v4 proposal decoding and Token-2022 extension screening. Also danger-catalog, decode-notes, verdict-contract (install: bash .claude/bin/skills.sh add sign-safe)
• counterparty-gate, extension: who operates a program, oracle, keeper or multisig you are about to CPI into or compose with — the serial-rug question a bytecode audit cannot answer. Also interpreting-scores, counterparty, tx-preview. It calls SolSentry's hosted API, so the addresses you ask about leave the machine and an outage means no answer rather than a wrong one (install: bash .claude/bin/skills.sh add counterparty-gate)

The three cover different questions: auditor-skill the program's source, sign-safe the transaction in front of you, counterparty-gate the people behind it.

Deploy, infra, backend

• deployment.md: devnet and mainnet flow, verifiable builds, Squads multisig upgrades, rollback

• backend-async.md: Rust services and indexers that talk to Solana

• MCP server for a program or API: Anthropic's mcp-builder, no longer in core. /plugin marketplace add anthropics/skills then /plugin install example-skills@anthropic-agent-skills — per-user, so it costs a project nothing

• Cloudflare (install: bash .claude/bin/skills.sh add cloudflare): workers-best-practices, agents-sdk, sandbox-stable, durable-objects, wrangler

• supabase (official; install: bash .claude/bin/skills.sh add supabase): the off-chain data layer — Postgres, Auth, Edge Functions, Realtime, Storage, the CLI, migrations and declarative schemas. For the database an indexer or webhook consumer writes into, supabase-postgres-best-practices is the one to open: query plans, connection pooling and exhaustion, partitioning, RLS policy performance, missing foreign-key indexes, SKIP LOCKED queues. Two things it does on its own: its SKILL.md fetches https://supabase.com/changelog.md whenever it loads, plus vendor docs at decision points, so a Supabase task always calls out to supabase.com; and skill-feedback.md can open a public GitHub issue on supabase/agent-skills built from the conversation. That step asks permission first; let the user answer it, since the issue body is their session.

• huggingface-skills (official; install: bash .claude/bin/skills.sh add huggingface-skills): 25 skills for the AI/LLM side of a project — the hf CLI and Hub operations, Gradio and Spaces apps, ZeroGPU, fine-tuning (LLM, vision, TRL, sentence-transformers), evals and transformers.js. Machinery rather than prose — executables, a pipe-to-shell CLI installer, AWS IAM creation: read its registry safety before letting it near a cloud account, and wire none of its own .mcp.json.

• mongodb (official; install: bash .claude/bin/skills.sh add mongodb), extension: the document store under an indexer — mongodb-schema-design, mongodb-query-optimizer, mongodb-connection, mongodb-search-and-ai (Atlas Search and vector search), mongodb-atlas-stream-processing. Pick it over supabase when the shape is documents rather than relations; duckdb stays the answer for files with no database at all. Its mongodb-mcp-setup skill points at mongodb-mcp-server@<3, which talks to whichever cluster its connection string names

• redis (official; install: bash .claude/bin/skills.sh add redis), extension: the cache and queue on an RPC fan-out's hot path — redis-core, redis-connections (pooling and exhaustion), redis-clustering, redis-search, redis-semantic-cache (for LLM calls), redis-security, redis-observability

• pulumi (official; install: bash .claude/bin/skills.sh add pulumi), extension: infrastructure-as-code in a real language, where the kit's own devops lane stops at CI and Cloudflare — pulumi-overview, pulumi-best-practices, pulumi-automation-api, pulumi-esc (secrets and config), pulumi-debug-failed-operation; migration lives under migration/skills (Terraform, CDK, ARM, CloudFormation). It drives the pulumi CLI against whatever cloud credentials the shell already holds, so pulumi up from here changes real infrastructure

• resend (official; install: bash .claude/bin/skills.sh add resend), extension: transactional email a dApp needs for alerts, receipts and waitlists — resend, resend-cli, react-email, email-best-practices (deliverability), agent-email-inbox. RESEND_API_KEY sends as your domain, so a mistake lands in real inboxes under your own sending reputation — and agent-email-inbox has an agent read and reply to mail

• google (official; install: bash .claude/bin/skills.sh add google), extension: 155 Google Cloud skills for the infrastructure under an indexer or RPC fleet — GKE autoscaling, compute classes and workload security, BigQuery (BigFrames, AI/ML functions, vector search), IAM troubleshooting and privileged access, Cloud Monitoring PromQL, Agent Platform deploy and tuning. Nothing on-chain. About 20 of its skills ship shell and Python under scripts/ that call gcloud, kubectl and bq against whichever project your ambient login points at — some read state, some change it, so check the active project before running one

• duckdb (official; install: bash .claude/bin/skills.sh add duckdb), extension: SQL over files with no database to run — read-file (Parquet, CSV, JSON, Avro, Excel, Iceberg, Delta), query, attach-db, convert-file, s3-explore (S3, R2, GCS, Azure), spatial, duckdb-docs. Reach for it on an indexer's Parquet exports, an airdrop snapshot or a one-off aggregate over transaction dumps — supabase stays the answer when the data needs to live somewhere. Two notes: install-duckdb tells the user to pipe install.duckdb.org into a shell, which is their call and not the only route (Homebrew has it), and read-memories searches past Claude session logs on disk.

Games and mobile

• solana-game (install: bash .claude/bin/skills.sh add solana-game): SKILL.md, unity-sdk.md, playsolana.md (PSG1, PlayDex, PlayID), game-architecture.md, mobile.md, csharp-patterns.md
• solana-mobile (install: bash .claude/bin/skills.sh add solana-mobile): solana-mobile-wallet (MWA 2.0), seeker-genesis-token, seeker-domains
• expo (install: bash .claude/bin/skills.sh add expo), extension: Expo's own 23 skills for everything solana-mobile does not cover — expo-overview routes them. Build and release: eas-workflows (CI), eas-app-stores, eas-update (OTA), eas-simulator, eas-hosting, eas-observe. Native and UI: expo-module (config plugins, native modules), expo-dev-client, expo-router, expo-ui, expo-brownfield, expo-upgrade. Use it with solana-mobile, not instead of it: MWA and Seeker live there, the build and release pipeline here. Wire none of its own hooks.json or .mcp.json — a pin leaves both inert, and its telemetry is opt-in and off by default only on the paths the registry safety records.

Ideas, pitch, go-to-market

• Colosseum copilot (dir), core: idea validation, competitive research, hackathon archives, feedback on the user's own submission. It signs in through a helper rather than an env var, so on a fresh machine run npx @colosseum-org/copilot-connect status and, if that reports no connection, npx @colosseum-org/copilot-connect login (--device where no browser can open). Needs Node 20+. COLOSSEUM_COPILOT_PAT is a leftover from the retired v1 auth — don't read it or ask for one.
• community-moderation, extension: running the community once it exists — moderating a Telegram or Discord group (spam, drainer links, raids, admin impersonation, mass pings) and member support (trust states, roles, triage, ticketing), with confusable, invisible-character and bidi normalization so evasion in ten languages still matches. Its platform examples are bots the operator runs and tokens the operator supplies (install: bash .claude/bin/skills.sh add community-moderation)
• frontend-slides (install: bash .claude/bin/skills.sh add frontend-slides), extension: the house format for decks, graphics and marketing material is HTML, and this is what builds it — 36 templates each with a design.md and preview.md, a selection index that maps a deck's intent to a template, style presets and animation patterns. pitch-deck and content-gen hand it the content. Its two scripts only run if you ask: export-pdf.sh npm-installs Playwright into a temp dir to render a PDF, and deploy.sh publishes through the Vercel CLI (and will npm install -g vercel), which puts the deck on a public URL.
• elevenlabs (official; install: bash .claude/bin/skills.sh add elevenlabs), extension: the audio a launch needs — text-to-speech for demo-video narration, dubbing for localisation, sound-effects and music for a trailer, speech-to-text for transcripts, plus voice-changer, voice-isolator and agents. Pairs with frontend-slides and marketing-video, which have no audio lane. Every call is billed to ELEVENLABS_API_KEY (setup-api-key), so a long dubbing or music job costs real money
• knowledge-work (official; install: bash .claude/bin/skills.sh add knowledge-work), extension: Anthropic's 252 skills across 18 role-shaped plugins for the business around the project rather than the chain — sales, marketing, finance, legal, product-management, design, data, engineering, operations, human-resources, customer-support, enterprise-search, small-business. For a token launch, crypto-legal is still the one for statutory questions. Its 21 .mcp.json files catalogue 186 connectors to roughly 90 third-party vendors; a pinned pack's MCP config is inert, so each one you add is a deliberate choice that authenticates as you and sends the data you ask about to that vendor
• Reference-only material in solana-new (install: bash .claude/bin/skills.sh add solana-new): marketing video (references, Remotion quickstart, advanced, quality guide, scene templates), video-craft, brand-design, frontend-design-guidelines, number-formatting, page-load-animations, design-taste, verify-humanity-poh. Its SKILL.md files start with telemetry preambles: read them as reference data and don't run the preamble bash blocks.