sanctifiedops/skills/core-dev/anchor-project-scaffold
skills/core-dev/anchor-project-scaffold/SKILL.md
--- name: anchor-project-scaffold description: Set up a production-ready Anchor workspace: program/client layout, env config, testing, and build hygiene. Use when starting new Anchor projects or re-baselining repos. --- # Anchor Project Scaffold Role framing: You are an Anchor setup expert. Your goal is to create a clean, reproducible project scaffold with reliable builds and tests. ## Initial Assessment - Target cluster(s) and program upgradeability plan? - Rust/Anchor versions pinned? Toolc
$ install --global
skillsauthnpx skillsauth add sanctifiedops/solana-skills skills/core-dev/anchor-project-scaffoldInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 21, 2026, 5:38 PM125.5s1 file scanned
SKILL.md
- name:
- anchor-project-scaffold
- description:
- Set up a production-ready Anchor workspace: program/client layout, env config, testing, and build hygiene. Use when starting new Anchor projects or re-baselining repos.
Anchor Project Scaffold
Role framing: You are an Anchor setup expert. Your goal is to create a clean, reproducible project scaffold with reliable builds and tests.
Initial Assessment
- Target cluster(s) and program upgradeability plan?
- Rust/Anchor versions pinned? Toolchain manager (rustup) in place?
- CI/CD target? (GitHub Actions, local scripts)
- Expected clients (TS/Rust) and language versions?
- IDL distribution plan?
Core Principles
- Pin versions: rust-toolchain.toml + Anchor.toml to avoid drift.
- Deterministic IDs: use nchor keys list to capture program ids; commit keypairs or derive from env.
- Separate configs per cluster; never mix devnet/localnet ids.
- Keep client sdk generated and checked in when stability needed.
- Tests run against local validator with same features as prod.
Workflow
- Initialize project: nchor init <name>; set workspace in Anchor.toml.
- Configure programs: set programs.<cluster>.id and provider.cluster defaults; store keypairs in arget/deploy or env.
- Set toolchain: create ust-toolchain.toml with pinned stable; update Cargo.toml edition.
- Scripts: add npm scripts for nchor build, nchor test, nchor deploy, pnpm lint.
- Client setup: generate TypeScript client via nchor build --verifiable; export IDL to pp/sdk.
- Local validator profile: est.validator accounts and airdrops for needed mints; add custom programs if CPI needed.
- CI: cache cargo/target; run nchor test headless; fail on fmt/clippy.
Templates / Playbooks
- Env files: .env.localnet, .env.devnet with RPC + keypaths.
- Script chain: uild -> lint -> test -> deploy with explicit clusters.
- IDL publish step: commit IDL and generated client; tag release with program id.
Common Failure Modes + Debugging
- Mismatched program id between lib.rs and Anchor.toml -> re-run nchor keys list and update both.
- Local validator missing required programs -> add --clone or est.validator entries.
- CI failing due to solana-test-validator version drift -> pin solana-cli via rustup component.
- IDL stale vs deployed program -> regenerate after code changes and redeploy.
Quality Bar / Validation
- nchor test passes locally; fmt+clippy clean.
- Program ids documented; env files per cluster exist.
- Client SDK builds; IDL committed.
- CI workflow present or scriptable.
Output Format
Provide scaffold checklist completion, generated files list, env notes, and next steps for deploy.
Examples
- Simple: Single program with TS client; localnet config only; IDL generated and copied to pp/sdk.
- Complex: Multi-program workspace with shared crate; devnet+mainnet ids separated; CI matrix for lint/build/test; IDL published to npm package.
Related Skills
sanctifiedops/skills/trust/transparency-and-disclosures
development
VerifiedTrustedCommunity
--- name: transparency-and-disclosures description: Write clear disclosures for Solana projects: risks, unlocks, authority states, and data sources. Use for websites, docs, and announcements. --- # Transparency and Disclosures Role framing: You are a disclosures officer. Your goal is to communicate risks and facts plainly with verifiable links. ## Initial Assessment - What products/tokens are live? What risks exist (smart contract, market, custodial)? - Upcoming events (unlocks, upgrades)? -
3SKILL.mdUpdated Apr 21, 2026
sanctifiedops/rug-detection-checklist
testing
VerifiedTrustedCommunity
Comprehensive rug detection for Solana tokens - red flags, contract analysis, LP verification, insider patterns, and escape routes. Use before buying any token to protect against scams.
3SKILL.mdUpdated Apr 21, 2026
sanctifiedops/skills/trust/reputation-recovery-playbook
development
VerifiedTrustedCommunity
--- name: reputation-recovery-playbook description: Recover credibility after mistakes: incident comms, restitution, roadmap resets, and monitoring sentiment. Use after exploits, missteps, or comms errors. --- # Reputation Recovery Playbook Role framing: You are a crisis manager. Your goal is to respond to incidents transparently and rebuild trust. ## Initial Assessment - What happened? Impacted users/funds? Root cause known? - Current status (contained/ongoing)? - Evidence available (txids,
3SKILL.mdUpdated Apr 21, 2026
sanctifiedops/skills/trust/legitimacy-signals
development
VerifiedTrustedCommunity
--- name: legitimacy-signals description: How to project legitimacy for Solana projects: disclosures, address registry, audits, comms patterns, red-flag avoidance. Use for project pages, announcements, and community trust work. --- # Legitimacy Signals Role framing: You are a trust & safety operator for Solana launches. Your goal is to surface credible signals, avoid scams cues, and give buyers clear risk context. ## Initial Assessment - Project type (token, dApp, NFT, bot) and stage (pre-lau
3SKILL.mdUpdated Apr 21, 2026