Safe Solana Builder
github.com/frankcastleauditor/safe-solana-builder- Category
- Developer Tools
- Rank
- No. 1164Tools index
- Pricing
- Open Source
- Type
- TOOL
- Use case
- Coding · Security & Identity
- Interfaces
- Agent Skill / Plugin
- Builder
- @Frankcastleauditor
- GitHub
- 142 stars
- Latest release
- v1.0.0
- Date
About
A Claude skill that writes production-grade, security-first Solana programs with built-in vulnerability protection. It generates complete project scaffolds with security checks, test files, and audit-ready code for both Anchor and Native Rust frameworks.
What it does
It guides an AI coding session through framework selection, test strategy, risk classification, requirements gathering, implementation, and security documentation. Its reference layers cover shared Solana hazards plus rules specific to Anchor, Native Rust, Pinocchio, and LiteSVM. The intended output includes build configuration, program code, tests, and an explicit record of assumptions and limitations.
Why it's ranked here
The strongest case is disciplined coverage, not automatic safety. The material addresses account identity, canonical PDA bumps, checked arithmetic, duplicate mutable accounts, cross-program calls, stale state, Token-2022, and lifecycle risks. The workflow also makes risk and assumptions visible. Confidence is tempered by limited examples and by security tests that may remain scaffolded rather than implemented.
What's good
The rules explain concrete failure modes and pair them with enforceable patterns. Framework selection changes the validation approach instead of merely changing syntax. Testing guidance covers failure paths, time control, account closure, state assertions, and compute usage. Generated work must also document applied rules, high-risk decisions, assumptions, and known limitations, which gives auditors a useful starting map.
Tradeoffs
This is a reference-driven coding workflow, not a compiler, static analyzer, test runner, or security audit. Some security edge cases may be left as explained placeholders. The included example covers an Anchor NFT mint, while Native Rust and Pinocchio examples are planned. LiteSVM approximates validator behavior and has partial RPC coverage, so wallet, RPC, and real-validator integration still need separate testing.
How to use it well
Use it when an AI is drafting a new Solana program and you want security decisions made before implementation. Choose the framework and testing method deliberately, supply account relationships and authority rules, then complete every placeholder test and verify the generated project locally. It suits developers and auditors who can challenge assumptions. It does not replace threat modeling, dependency review, deployment controls, validator-level integration tests, or an independent audit.
Technical notes+
SKILL.md orchestrates framework and testing questions, loads references/shared-base.md plus references/anchor.md, references/native-rust.md, or references/pinocchio.md, and optionally references/litesvm.md before risk classification and generation. references/shared-base.md supplies cross-framework rules for identity, PDAs, arithmetic, CPI, and account lifecycle. Framework files translate those rules into Anchor constraints, manual Native Rust validation, or Pinocchio zero-copy patterns. references/litesvm.md specifies an in-process test harness, sysvar manipulation, account injection, simulation, and compute-unit collection. examples/nft-whitelist-mint/lib.rs provides the repository's Anchor implementation example; README.md says its companion checklist records 31 rules.
Observed
- License
- MIT
- Packaging and installation
- Distributed as a Claude .skill upload; the repository can also be cloned into Cursor's skills directory and referenced as a context rule.
- Interfaces
- AI coding workflow skill for Claude and Cursor; no CLI, library API, MCP server, or hosted API is described.
- Framework support
- Reference coverage is provided for Anchor, Native Rust, and Pinocchio.
- Testing support
- Supports LiteSVM guidance or each framework's default testing approach.
- Repository composition
- The supplied tree contains Markdown orchestration and reference material plus one Rust Anchor NFT whitelist mint example.
Read from README.md, examples/nft-whitelist-mint/lib.rs, SKILL.md, references/anchor.md, references/litesvm.md, references/pinocchio.md, references/native-rust.md, references/shared-base.md.
What it can do
Generate production-grade Solana programs with security protections
Program requirements and specifications → Security-hardened Solana program code
Create complete project scaffolds for Solana development
Project type and framework choice (Anchor or Native Rust) → Full project structure with files and configuration
Generate comprehensive test files for Solana programs
Solana program code → Test suite files with security test cases
Perform built-in security vulnerability checks
Solana program code → Security analysis and vulnerability warnings
Create audit-ready code with security documentation
Program specifications → Documented code meeting audit standards
Generate security checklists for Solana programs
Program type and requirements → Comprehensive security checklist
Identify potential edge cases and security risks
Solana program logic and structure → List of pre-identified edge cases and risk scenarios
Tags
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.