SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
pump-solana-wallet
0
Secure Solana wallet generation using official Solana Labs libraries — Ed25519 keypairs, memory zeroization, vanity address generation, offline-only operation, and multi-language implementations (Rust, TypeScript, Bash).
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Solana Wallet — Key Generation & Security Secure Solana wallet generation using official Solana Labs libraries with Ed25519 keys, memory zeroization, and offline-only operation. Three implementations: Rust (production), TypeScript (educational), and Bash (wrappers). ## Approved Crypto Libraries | Context | Library | Role | |---------|---------|------| | Rust | `solana-sdk` | `Keypair::new()`, `Signer` trait, Base58 encoding | | TypeScript | `@solana/web3.js` | `Keypair.generate()`, `Keypair.fromSecretKey()` | | Shell | `solana-keygen` | `grind` (vanity), `new` (random), `verify` | | MCP Server | `@solana/web3.js` | Session keypair management in `SolanaWalletMCPServer` | ## Address Format - 32-byte Ed25519 public key encoded as Base58 - Length: 32–44 characters (typically 43–44) - Case-sensitive alphabet: `123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz` ## Vanity Address Difficulty | Prefix Length | Expected Attempts | Time (100K/sec) | |---------------|-------------------|-----------------| | 1 char | ~58 | < 1 sec | | 2 chars | ~3,364 | < 1 sec | | 3 chars | ~195,112 | ~2 sec | | 4 chars | ~11.3M | ~2 min | | 5 chars | ~656M | ~2 hours | ## Security Model (6 Defense Layers) 1. **CSPRNG only** — `OsRng` (Rust), `crypto.getRandomValues` (Node.js) 2. **Official libraries** — No third-party crypto 3. **Memory zeroization** — `Zeroize` trait (Rust), `buffer.fill(0)` (TypeScript) 4. **File permissions** — `0o600` owner-only 5. **Offline operation** — No network calls during key generation 6. **Post-generation verification** — Re-derive public key from secret and compare ## Memory Zeroization by Language | Language | Mechanism | |----------|-----------| | Rust | `Zeroize` trait + `Drop` impl, `zeroize_on_drop` | | TypeScript | `secretKey.fill(0)` + `Buffer.alloc(0)` (best-effort, GC may relocate) | | Shell | `shred -u` or `rm -P` for file cleanup | ## Patterns to Follow - ONLY use `solana-sdk`, `@solana/web3.js`, or `solana-keygen` for crypto operations - Zero all key material as soon as it is no longer needed - Set file permissions to `0o600` immediately after writing keypair files - Never make network calls during key generation - Verify every generated keypair: re-derive public key from secret and compare ## Common Pitfalls - JavaScript GC may copy/relocate buffers — `fill(0)` is best-effort, not guaranteed - `solana-keygen` output is [u8; 64] JSON array (32-byte secret + 32-byte public) - Base58 is NOT the same as Base64 — Solana uses a specific alphabet without `0OIl` - Vanity matching must use raw Base58 — case-sensitive, no regex anchoring errors