feat: add /solana skill — 7-mode Solana development lifecycle#735
Open
scriptscrypt wants to merge 1 commit intogarrytan:mainfrom
Open
feat: add /solana skill — 7-mode Solana development lifecycle#735scriptscrypt wants to merge 1 commit intogarrytan:mainfrom
scriptscrypt wants to merge 1 commit intogarrytan:mainfrom
Conversation
Adds a comprehensive /solana skill with seven modes covering the full Solana development lifecycle: ideas, build, audit, deploy, monitor, debug, and ecosystem discovery. Build mode includes specialized sub-routes for DeFi protocols, token launches, Blinks/Actions, data pipelines, mobile apps, AI agents, and NFTs. Supports both Anchor and Pinocchio frameworks, Token-2022 extensions, compute unit optimization, and fast local testing with Bankrun/LiteSVM/Surfpool. Also adds a Solana specialist reviewer that auto-triggers during /review when Anchor or solana-program code is detected, covering 9 vulnerability categories including Sealevel-specific exploits and Token-2022 extension patterns. Ecosystem mode references the solana-new CLI catalog (67 repos, 71 skills, 49 MCPs) for project-specific tool recommendations.
mehmoodosman
pushed a commit
to mehmoodosman/gstack
that referenced
this pull request
Apr 1, 2026
This commit fixes a critical security vulnerability where IPv4-mapped IPv6 addresses could bypass the cloud metadata endpoint protection. Vulnerability Details: - The metadata IP 169.254.169.254 (AWS/GCP/Azure metadata endpoint) could be accessed using IPv4-mapped IPv6 addresses like ::ffff:169.254.169.254 or ::ffff:a9fe:a9fe - These formats bypassed the existing isMetadataIp() check which only normalized via the URL constructor, not handling the IPv4-in-IPv6 embedding Changes Made: 1. Added extractIpv4FromMappedIpv6() function to detect and extract IPv4 addresses from IPv4-mapped IPv6 formats: - ::ffff:x.x.x.x (standard IPv4-mapped) - ::x.x.x.x (deprecated IPv4-compatible) - Full forms with all 8 groups - Hex-encoded forms (a9fe:a9fe representing 169.254.169.254) 2. Updated isMetadataIp() to use the new extraction function and check if the extracted IPv4 is a blocked metadata endpoint 3. Added comprehensive test cases for all IPv4-mapped IPv6 bypass variants: - ::ffff:169.254.169.254 - ::ffff:a9fe:a9fe (hex encoding) - ::169.254.169.254 (deprecated) - Full forms with 8 groups - Hex-encoded full forms Security Impact: HIGH - This prevents SSRF attacks targeting cloud metadata endpoints via IPv6 address encoding bypasses. Fixes: garrytan#735 (security advisory)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/solanaskill with 7 modes: ideas, build, audit, deploy, monitor, debug, ecosystem — covering the full Solana development lifecycle from idea to production/reviewwhen Anchor/solana-program code is detected, covering 9 vulnerability categories including Sealevel-specific exploits and Token-2022 extension patternsWhat's in the skill
/solana ideas/solana build/solana audit/solana deploy/solana monitor/solana debug/solana ecosystemKey features
Files changed
solana/SKILL.md.tmplsolana/SKILL.mdreview/specialists/solana.mdreview/SKILL.mdscripts/resolvers/review-army.tsTest plan
bun test test/skill-validation.test.ts test/gen-skill-docs.test.ts— 658 pass, 0 failbun run gen:skill-docsregenerates cleanly/solanain a project with Anchor.toml — should route to build mode/solana ideasin empty dir — should start discovery flow/reviewon Solana program — should dispatch Solana specialist