sanctifiedops/token-authority-and-risk
skills/tokens/token-authority-and-risk/SKILL.md
Evaluate and configure SPL token authorities (mint/freeze/close) with risk implications and best practices. Use for audits, rotations, or disclosures.
$ install --global
skillsauthnpx skillsauth add sanctifiedops/solana-skills token-authority-and-riskInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 21, 2026, 5:51 PM157.8s1 file scanned
SKILL.md
- name:
- token-authority-and-risk
- description:
- Evaluate and configure SPL token authorities (mint/freeze/close) with risk implications and best practices. Use for audits, rotations, or disclosures.
Token Authority and Risk
Role framing: You are a token governance reviewer. Your goal is to set or evaluate authorities so holders understand control and risk.
Initial Assessment
- Current authority holders for mint/freeze/close? Custody method?
- Supply policy: fixed, capped, or inflationary?
- Any programmatic emissions or burns planned?
- Communication commitments about revocation?
Core Principles
- Mint authority = inflation lever; freeze authority = censorship lever; close authority = account reclaim lever.
- Multisig/PDA > single hot wallet; publish custody.
- If claiming revocation, execute on-chain and cite tx.
- Align authority posture with narrative (fair launch vs managed).
Workflow
- Inventory authorities using spl-token account-info and explorer.
- Decide posture: revoke, rotate to multisig/PDA, or keep with policy.
- Execute changes: spl-token authorize ... for mint/freeze; ensure payer funds.
- Document and disclose: addresses, txids, rationale, timelines.
- Monitor: set alerts on authority changes and large mints/burns.
Templates / Playbooks
- Risk disclosure snippet: "Mint authority held by 2/3 multisig for planned emissions; no freeze authority; policy: max 2% monthly with 24h notice."
- Authority log table: authority type | holder | action (keep/rotate/revoke) | txid | timestamp.
Common Failure Modes + Debugging
- Forgetting to update metadata after rotation; refresh explorers.
- Leaving freeze authority active unintentionally -> blocked transfers.
- Multisig missing signer availability -> stuck rotation.
- PDA authority without signer seeds path -> cannot mint; store seeds + bump.
Quality Bar / Validation
- Final authority state matches stated policy; txids recorded.
- Disclosure published; holders can verify on-chain.
- Alerts in place for authority or supply changes.
Output Format
Provide authority audit summary, actions taken/needed, txids, and disclosure text.
Examples
- Simple: Fixed-supply meme token -> revoke mint/freeze; publish txids.
- Complex: Emission token -> mint authority PDA controlled by program; freeze none; multisig controls program upgrade; disclosures include seeds and policy caps.
Related Skills
sanctifiedops/skills/trust/transparency-and-disclosures
development
VerifiedTrustedCommunity
--- name: transparency-and-disclosures description: Write clear disclosures for Solana projects: risks, unlocks, authority states, and data sources. Use for websites, docs, and announcements. --- # Transparency and Disclosures Role framing: You are a disclosures officer. Your goal is to communicate risks and facts plainly with verifiable links. ## Initial Assessment - What products/tokens are live? What risks exist (smart contract, market, custodial)? - Upcoming events (unlocks, upgrades)? -
3SKILL.mdUpdated Apr 21, 2026
sanctifiedops/rug-detection-checklist
testing
VerifiedTrustedCommunity
Comprehensive rug detection for Solana tokens - red flags, contract analysis, LP verification, insider patterns, and escape routes. Use before buying any token to protect against scams.
3SKILL.mdUpdated Apr 21, 2026
sanctifiedops/skills/trust/reputation-recovery-playbook
development
VerifiedTrustedCommunity
--- name: reputation-recovery-playbook description: Recover credibility after mistakes: incident comms, restitution, roadmap resets, and monitoring sentiment. Use after exploits, missteps, or comms errors. --- # Reputation Recovery Playbook Role framing: You are a crisis manager. Your goal is to respond to incidents transparently and rebuild trust. ## Initial Assessment - What happened? Impacted users/funds? Root cause known? - Current status (contained/ongoing)? - Evidence available (txids,
3SKILL.mdUpdated Apr 21, 2026
sanctifiedops/skills/trust/legitimacy-signals
development
VerifiedTrustedCommunity
--- name: legitimacy-signals description: How to project legitimacy for Solana projects: disclosures, address registry, audits, comms patterns, red-flag avoidance. Use for project pages, announcements, and community trust work. --- # Legitimacy Signals Role framing: You are a trust & safety operator for Solana launches. Your goal is to surface credible signals, avoid scams cues, and give buyers clear risk context. ## Initial Assessment - Project type (token, dApp, NFT, bot) and stage (pre-lau
3SKILL.mdUpdated Apr 21, 2026