What is solana-audit-flow?

An end-to-end security-audit process for Solana programs written in Anchor or Rust. Solana programs are blockchain programs, and Anchor is a Rust framework used to build them.

It is for auditing a Solana codebase from compilation through confirmed findings. Jobs include running host tools, testing with LiteSVM, and using Trident or cargo-fuzz to explore unexpected inputs.

The process does not assume that common static-analysis tools work for Solana. It combines compiler warnings, manual code reading, tests, and fuzzing to find and verify logic problems.

solana-audit-flow — Skill for Claude Code and Codex by mtarcure

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add mtarcure/claude-vibe-squad --skill solana-audit-flow

Clone the repo

git clone --depth 1 https://github.com/mtarcure/claude-vibe-squad

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/mtarcure/claude-vibe-squad/solana-audit-flow/github.svg)](https://agentmods.dev/skills/mtarcure/claude-vibe-squad/solana-audit-flow)

Your own site

<a href="https://agentmods.dev/skills/mtarcure/claude-vibe-squad/solana-audit-flow"><img src="https://agentmods.dev/badge/skills/mtarcure/claude-vibe-squad/solana-audit-flow/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/mtarcure/claude-vibe-squad/solana-audit-flow"><img src="https://agentmods.dev/badge/skills/mtarcure/claude-vibe-squad/solana-audit-flow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 69 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,358 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00069	$0.01358
Opus 5.5	$0.00028	$0.00543
Sonnet 5.5	$0.00014	$0.00272
Haiku 4.5	$0.00007	$0.00136

Measured 1mo ago against content hash 5c7adff22c42, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

solana-audit-flow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/solana-audit-flow/SKILL.md · 96 lines

How it starts

The opening of the file, as written. The whole thing — 96 lines — stays where its author put it; the contents beside it link to each section on GitHub.

solana-audit-flow

Stateful Solana program audit pipeline from Anchor/Rust source through confirmed-finding delivery. Use for a Rust/Anchor workspace or a bare solana_program program. Every step runs a native host tool (anchor, cargo, trident, cargo-fuzz, solana) or a target- project dev-crate (litesvm, run via cargo test). There is no static-analysis step: Slither has zero Solana detectors, so any "slither Solana scan" is a fabricated capability — manual review (vulnhunter-solana) plus dynamic fuzzing is the coverage model on Solana.

Order of ops

Build and lint. anchor build (or cargo build-sbf for a bare program) to confirm a clean compile. Surface ALL compiler warnings — Rust warnings on Solana programs often indicate logic bugs (unused return values, dead paths). Never dismiss #[allow(unused)] without checking what it suppresses. Confirm the toolchain version is already installed; do not run avm use <version> blindly — it can trigger an agave-install network download (no silent installs). If a version mismatch blocks the build, surface it as a ## NEEDS FROM CHRONO item rather than auto-installing.
Manual vuln-pattern review (primary coverage). Apply vulnhunter-solana: account ownership checks (account.owner != program_id), discriminator validation on deserialized accounts, signer checks on privileged instructions, CPI signer validation (caller-controlled signer_seeds), SPL token math overflow, PDA seed collision, unchecked data.borrow_mut(). This is step 2 (not a late step) because there is no static tool to lean on first.
Unit test run. Run the existing suite with cargo test (LiteSVM-backed tests are preferred over solana-program-test for speed; both run under cargo test). A failing test in a security-sensitive instruction is often a direct finding.
Coverage-guided fuzzing.
- Trident for Anchor-aware, IDL-driven fuzzing: trident fuzz run <target>. Trident generates fuzz instructions from the IDL and checks invariants; write custom FuzzInstruction impls for complex state-machine properties.
- cargo-fuzz (libFuzzer) for bare parsing/deserialization surfaces and non-Anchor programs: cargo fuzz run <target>.

Read the full file on GitHub · 96 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 96 lines · 69 tokens per session scan A 5c7adff22c42

Subscribe to this mod's changes

solana-audit-flow is a skill published in the GitHub repository mtarcure/claude-vibe-squad (165 stars, last pushed 1mo ago), licensed MIT. It adds 69 tokens to every session and 1,358 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-19.

Claude Code Security Web3 and blockchain agent-orchestration ai-agents cli kimi mcp

pay

Pay one external payment requirement within exact parent authority, through a payment method the payer holds, and read the paid resource back.

runxhq/runx · 27 tokens

aomi-transact

Build natural-language crypto/DeFi agents and EVM MCP plugins (Claude Code, Cursor, Codex, Gemini). Aomi turns prompts into wallet-signed txs on Ethereum, Base, Arbitrum, Optimism, Polygon, Linea — non-custodial, fork-simulated. 40+ apps: Uniswap, Aave, Lido, Morpho, GMX, Hyperliquid, Polymarket.

Ghosteken/agent-harness · 95 tokens

solana-audit-flow

Getting it into your agent

Wrote this? Show the measurements

What it costs to keep this loaded

Grade A, and why

Nothing flagged

How it starts

solana-audit-flow

Order of ops

What this file has done since we first saw it

Other skills, from other repositories

pay

aomi-transact

codew-release-qa-sweep

gh-file-issue

gh-treasure-hunt

document