[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71KM4BY6EB05R41BJFSDM6R":3,"skill-same:01M71KM4BY6EB05R41BJFSDM6R":71},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":52,"ownerHtmlUrl":53,"ownerBlogUrl":54,"ownerDescription":55,"updatedAt":56,"install":57,"resources":70},"01M71KM4BY6EB05R41BJFSDM6R","pump-security",null,"Defense-in-depth security across Rust, TypeScript, and Bash for the Pump SDK — cryptographic key handling, memory zeroization, secure file I\u002FO, input validation, privilege management, dependency auditing, and a 60+ item security checklist.","clawdsolana\u002FOpenClawd","clawdsolana","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F279036008?v=4","01M71JTVF9FNGKE2SVJRPTQM31","OpenClawd","01M71JTVGCKWBSS8ZYC1HYWVA5",2,"MIT","https:\u002F\u002Fgithub.com\u002Fclawdsolana\u002FOpenClawd\u002Fblob\u002Fmain\u002Fskills\u002Fpump-security\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"pump","security","pump security","https","sdk","dependency","privilege","github","across","file","Bash","pump-fun","Input Validation","depth","security checklist","rust","defense-in-depth","fun","for","memory","2026-11-10 10:12:30",false,"---\nname: pump-security\ndescription: \"Defense-in-depth security across Rust, TypeScript, and Bash for the Pump SDK — cryptographic key handling, memory zeroization, secure file I\u002FO, input validation, privilege management, dependency auditing, and a 60+ item security checklist.\"\nmetadata:\n  solanaos:\n    homepage: https:\u002F\u002Fgithub.com\u002Fnirholas\u002Fpump-fun-sdk\n---\n\n# Security Practices — Cryptographic Safety, Memory Zeroization & Hardened I\u002FO\n\nDefense-in-depth security across Rust, TypeScript, and Bash: key handling, memory zeroization, secure file I\u002FO, input validation, privilege management, and dependency auditing.\n\n## Memory Zeroization\n\n### Rust\n```rust\nuse zeroize::Zeroize;\n\nstruct SecureBytes(Vec\u003Cu8>);\n\nimpl Drop for SecureBytes {\n    fn drop(&mut self) {\n        self.0.zeroize();\n    }\n}\n```\n\n### TypeScript\n```typescript\ntry {\n    \u002F\u002F ... use secretKey\n} finally {\n    secretKey.fill(0);\n    \u002F\u002F Best-effort: GC may have copied the buffer\n}\n```\n\n### Shell\n```bash\nshred -u \"$keypair_file\" 2>\u002Fdev\u002Fnull || rm -P \"$keypair_file\"\n```\n\n## RNG Quality\n\n| Language | Source | Verification |\n|----------|--------|-------------|\n| Rust | `OsRng` | Verify via `solana-sdk` internals |\n| TypeScript | `crypto.getRandomValues` | Node.js built-in CSPRNG |\n| Shell | `solana-keygen` | Delegates to Rust `OsRng` |\n\n## Keypair Integrity Verification\n\n1. Re-derive public key from secret key\n2. Compare derived key with stored public key\n3. Sign a test message with the keypair\n4. Verify the signature with the public key\n5. Validate Base58 encoding roundtrip\n\n## Secure File I\u002FO\n\n- Set permissions to `0o600` before writing content (race-free on Unix)\n- Use `O_CREAT | O_EXCL` to prevent overwrites\n- Write to temp file + atomic rename for crash safety\n- Never write secret keys to stdout unless explicitly requested\n\n## Input Validation\n\n| Input | Validation |\n|-------|-----------|\n| Base58 address | Regex: `^[1-9A-HJ-NP-Za-km-z]{32,44}$` |\n| File paths | Reject `..`, prevent traversal |\n| Tool inputs | Zod schemas in MCP server |\n| Shell arguments | Quoted variables, no eval |\n\n## Security Checklist Summary (60+ items)\n\nKey categories:\n- Cryptographic library allowlist\n- Memory zeroization in all code paths\n- File permission enforcement\n- Input validation and sanitization\n- Error message information leakage prevention\n- Dependency auditing (`cargo audit`, `npm audit`)\n- No network calls during key generation\n- Secret key never in logs, error messages, or telemetry\n\n## Attack Vectors to Test\n\n| Vector | Defense |\n|--------|---------|\n| Weak RNG | Only CSPRNG (OsRng \u002F crypto.getRandomValues) |\n| Memory dump | Zeroize on drop\u002Ffinally |\n| File permission leak | 0o600 enforcement |\n| Path traversal | Input validation |\n| Shell injection | Quoted variables, no eval |\n| Dependency supply chain | cargo audit, npm audit |\n\n## Patterns to Follow\n\n- Always use approved crypto libraries: `solana-sdk`, `@solana\u002Fweb3.js`, `solana-keygen`\n- Zeroize key material in all code paths (success, error, early return)\n- Set file permissions before writing content\n- Validate all inputs at the boundary (CLI args, API inputs, file paths)\n- Never log or display secret keys\n- Run dependency audits in CI\n\n## Common Pitfalls\n\n- JavaScript `fill(0)` is best-effort — GC may relocate buffers\n- Rust `String` types may leave copies in memory — use `Vec\u003Cu8>` with `Zeroize`\n- `chmod` after `write` has a race window — prefer `fchmod` or umask\n- Error messages must not include secret key material\n- `cargo audit` may miss recently disclosed CVEs — supplement with manual review\n\n","# Security Practices — Cryptographic Safety, Memory Zeroization & Hardened I\u002FO\n\nDefense-in-depth security across Rust, TypeScript, and Bash: key handling, memory zeroization, secure file I\u002FO, input validation, privilege management, and dependency auditing.\n\n## Memory Zeroization\n\n### Rust\n```rust\nuse zeroize::Zeroize;\n\nstruct SecureBytes(Vec\u003Cu8>);\n\nimpl Drop for SecureBytes {\n    fn drop(&mut self) {\n        self.0.zeroize();\n    }\n}\n```\n\n### TypeScript\n```typescript\ntry {\n    \u002F\u002F ... use secretKey\n} finally {\n    secretKey.fill(0);\n    \u002F\u002F Best-effort: GC may have copied the buffer\n}\n```\n\n### Shell\n```bash\nshred -u \"$keypair_file\" 2>\u002Fdev\u002Fnull || rm -P \"$keypair_file\"\n```\n\n## RNG Quality\n\n| Language | Source | Verification |\n|----------|--------|-------------|\n| Rust | `OsRng` | Verify via `solana-sdk` internals |\n| TypeScript | `crypto.getRandomValues` | Node.js built-in CSPRNG |\n| Shell | `solana-keygen` | Delegates to Rust `OsRng` |\n\n## Keypair Integrity Verification\n\n1. Re-derive public key from secret key\n2. Compare derived key with stored public key\n3. Sign a test message with the keypair\n4. Verify the signature with the public key\n5. Validate Base58 encoding roundtrip\n\n## Secure File I\u002FO\n\n- Set permissions to `0o600` before writing content (race-free on Unix)\n- Use `O_CREAT | O_EXCL` to prevent overwrites\n- Write to temp file + atomic rename for crash safety\n- Never write secret keys to stdout unless explicitly requested\n\n## Input Validation\n\n| Input | Validation |\n|-------|-----------|\n| Base58 address | Regex: `^[1-9A-HJ-NP-Za-km-z]{32,44}$` |\n| File paths | Reject `..`, prevent traversal |\n| Tool inputs | Zod schemas in MCP server |\n| Shell arguments | Quoted variables, no eval |\n\n## Security Checklist Summary (60+ items)\n\nKey categories:\n- Cryptographic library allowlist\n- Memory zeroization in all code paths\n- File permission enforcement\n- Input validation and sanitization\n- Error message information leakage prevention\n- Dependency auditing (`cargo audit`, `npm audit`)\n- No network calls during key generation\n- Secret key never in logs, error messages, or telemetry\n\n## Attack Vectors to Test\n\n| Vector | Defense |\n|--------|---------|\n| Weak RNG | Only CSPRNG (OsRng \u002F crypto.getRandomValues) |\n| Memory dump | Zeroize on drop\u002Ffinally |\n| File permission leak | 0o600 enforcement |\n| Path traversal | Input validation |\n| Shell injection | Quoted variables, no eval |\n| Dependency supply chain | cargo audit, npm audit |\n\n## Patterns to Follow\n\n- Always use approved crypto libraries: `solana-sdk`, `@solana\u002Fweb3.js`, `solana-keygen`\n- Zeroize key material in all code paths (success, error, early return)\n- Set file permissions before writing content\n- Validate all inputs at the boundary (CLI args, API inputs, file paths)\n- Never log or display secret keys\n- Run dependency audits in CI\n\n## Common Pitfalls\n\n- JavaScript `fill(0)` is best-effort — GC may relocate buffers\n- Rust `String` types may leave copies in memory — use `Vec\u003Cu8>` with `Zeroize`\n- `chmod` after `write` has a race window — prefer `fchmod` or umask\n- Error messages must not include secret key material\n- `cargo audit` may miss recently disclosed CVEs — supplement with manual review\n\n",{"name":5,"metadata":44,"description":7},{"solanaos":45},{"homepage":46},"https:\u002F\u002Fgithub.com\u002Fnirholas\u002Fpump-fun-sdk","main","6b4a291df75c639681e93b4b5b812126443fd6ed","skills\u002Fpump-security",3,"https:\u002F\u002Fgithub.com\u002Fclawdsolana\u002FOpenClawd","https:\u002F\u002Fsolanaclawd.com\u002Fopenclawd","https:\u002F\u002Fgithub.com\u002Fclawdsolana","https:\u002F\u002Fmusebook.trade","Welcome to Open Clawd. The future of Ai on and off chain. Bringing webMCP to web 3 using X402, A2A, MPP and so much more!","2026-08-01 09:30:51",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add clawdsolana\u002FOpenClawd --skill pump-security",{"tool":63,"command":64},"bunx","bunx skills add clawdsolana\u002FOpenClawd --skill pump-security",{"tool":66,"command":67},"pnpm","pnpm dlx skills add clawdsolana\u002FOpenClawd --skill pump-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fclawdsolana\u002FOpenClawd\u002Fblob\u002Fmain\u002Fskills\u002Fpump-security\u002FSKILL.md",true,[],[72,104,131,157,167,191],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":83,"publishedAt":103},"01M71KRBD0W01EAXJ8YM4M1SJ2","solana-dev","End-to-end Solana development playbook (Jan 2026). Prefer Solana Foundation framework-kit (@solana\u002Fclient + @solana\u002Freact-hooks) for React\u002FNext.js UI. Prefer @solana\u002Fkit for all new client\u002FRPC\u002Ftransaction code. When legacy dependencies require web3.js, isolate it behind @solana\u002Fweb3-compat (or @solana\u002Fweb3.js as a true legacy fallback). Covers wallet-standard-first connection (incl. ConnectorKit), Anchor\u002FPinocchio programs, Codama-based client generation, LiteSVM\u002FMollusk\u002FSurfpool testing, and security checklists.","https:\u002F\u002Fgithub.com\u002Fclawdsolana\u002FOpenClawd\u002Fblob\u002Fmain\u002Fsrc\u002Fskills\u002Fsolana-dev\u002FSKILL.md",[78],{"categoryNo":79,"categoryName":80,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,20,100,101,102],"solana dev","dev","solana","Wallet","end","testing","hooks","kit","new","when","web3","code","react","next","2026","playbook","ui","fallback","framework","2026-11-10 10:56:23",{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":113,"publishedAt":103},"01M71KR8QPESSY61SVE8ZTFNVT","xurl","A CLI tool for making authenticated requests to the X (Twitter) API. Use this skill when you need to post tweets, reply, quote, search, read posts, manage followers, send DMs, upload media, or interact with any X API v2 endpoint.","https:\u002F\u002Fgithub.com\u002Fclawdsolana\u002FOpenClawd\u002Fblob\u002Fmain\u002Fskills\u002Fxurl\u002FSKILL.md",[110],{"categoryNo":111,"categoryName":112,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000023","Skill与智能体开发",[106,114,115,116,117,118,119,93,120,121,122,123,124,125,126,127,37,128,129,130],"posts","Media","x api","search","send","tap","you","api","cli","read","install","cli tool","endpoint","brew","manage","tool","twitter",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":138,"publishedAt":103},"01M71KR6FSXV88YDKWP7NBY3SH","wurk-integration","WURK API integration for monetizing agents with x402 payments on Solana\u002FBase - create social jobs, custom challenges, and agent help tasks","https:\u002F\u002Fgithub.com\u002Fclawdsolana\u002FOpenClawd\u002Fblob\u002Fmain\u002Fskills\u002Fwurk-integration\u002FSKILL.md",[137],{"categoryNo":111,"categoryName":112,"taxonomyType":81,"taxonomyTypeDesc":82},[139,140,141,142,143,144,145,146,121,147,148,149,150,151,152,153,37,154,155,156],"wurk","wurk integration","integration","x402","social","payments","tasks","team","create","social-jobs","command","agent-help","custom-jobs","clawd","safe","api integration","custom","true",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":103},"01M71KR4HCX41BPAK9GP7RPRRP","workflows","Manage application workflows including configuration, restart, and removal.","https:\u002F\u002Fgithub.com\u002Fclawdsolana\u002FOpenClawd\u002Fblob\u002Fmain\u002Fskills\u002Fworkflows\u002FSKILL.md",[],[159,128,164,165,166],"configuration","application","restart",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":173,"publishedAt":103},"01M71KR1VM0F5GPEQDNG5J7A0H","web-search","Search the web, fetch content, extract branding profiles, and capture screenshots from URLs. Use for real-time information, API documentation, current events, design matching, and visual reference.","https:\u002F\u002Fgithub.com\u002Fclawdsolana\u002FOpenClawd\u002Fblob\u002Fmain\u002Fskills\u002Fweb-search\u002FSKILL.md",[],[174,117,175,176,177,37,178,179,180,181,182,183,184,121,185,186,187,188,189,190],"web search","web","fetch","api documentation","real-time","time","profiles","design","use","information","visual","documentation","branding","matching","reference","capture","content",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":197,"publishedAt":103},"01M71KQZN5MR1JFQHG5GWXYAHS","weather","Get current weather and forecasts via wttr.in or Open-Meteo. Use when: user asks about weather, temperature, or forecasts for any location. NOT for: historical weather data, severe weather alerts, or detailed meteorological analysis. No API key needed.","https:\u002F\u002Fgithub.com\u002Fclawdsolana\u002FOpenClawd\u002Fblob\u002Fmain\u002Fskills\u002Fweather\u002FSKILL.md",[],[193,198,37,199,182,93,200,121,201,202,203,204,205,206,22,207,208,209],"get","open","analysis","alerts","temperature","curl","via","help","about","location","data","user"]