Solana Arb Executor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Solana Arb Executor (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Scaffold the Rust low-latency execution hot path for Solana arbitrage -- the on-chain `detect -> simulate -> bundle -> land` loop that analysis-only and TypeScript arb skills leave out.
A Claude Code / Codex skill that generates the execution layer: Yellowstone gRPC / ShredStream ingestion, spread/threshold detection, simulate-first Jito bundles with tip and leader timing, transaction landing with priority-fee sizing, and a real risk gate (exposure caps, circuit breaker, kill-switch) behind a typed human confirm-gate.
Solana arbitrage skills today stop before the hard part. The Python prior art analyzes -- it finds signals, backtests spreads, and prints a chart. The TypeScript arb skills quote venues and hand you a transaction, then punt the latency-sensitive landing path back to you. Nobody scaffolds the layer that actually has to run fast on-chain: ingest realtime account state, decide in microseconds, simulate, build a Jito bundle, size the tip, and land before the opportunity is consumed -- without blowing the account when a stale read or a bad streak hits.
There is no Rust low-latency execution skill. That is the white space this fills.
Routes an execution-infra request to exactly one focused leaf and emits real, importable Rust against pinned 2026 crates:
yellowstone-grpc-client account/slot subscription at processed commitment, with reconnect and backoff.VersionedTransaction + Address Lookup Tables (documented; the v0/ALT/signing build is delegated to solana-dev).RiskGate with max-notional / max-position / daily-loss caps, a consecutive-revert circuit breaker, and a kill-switch -- checked on every order before it can reach the confirm-gate.solana-dev skill.The closest prior art is agiprolabs/claude-trading-skills: a Python analysis toolkit -- signal generation, backtests, spread inspection. It tells you whether an edge might exist; it does not execute. The TypeScript arb skills stop at "here is a swap."
This skill is the execution layer those omit -- the Rust hot path that ingests, decides, simulates, bundles, and lands, with the risk and safety plumbing wired in. Analysis answers is there an edge; this answers how do I act on it without losing the account. It complements the TS arb/quant skills rather than duplicating them, and delegates program/Anchor work to solana-dev.
Retail spatial DEX arb is infrastructure-dominated. Raw price gaps are taken by parties with co-located bare-metal, private leader paths, and sub-10ms bundle budgets that a single-box bot will not match; Jito tips eat a large share of the gross edge on contested atomic ops (~50-60% of the extracted edge in 2025/2026), and there is no guaranteed-inclusion tip. Shaving microseconds off decode changes nothing when network RTT dominates.
Where retail edge actually survives: correct landing (simulate-first, right CU price, tip sizing, retry discipline so the txns you send actually land instead of burning fees on reverts), risk discipline (caps, breaker, kill-switch), and less-contested opportunities (funding-basis, cross-venue rate gaps, longer-horizon plays where latency is not the deciding factor). That is what this skill leads with. It is scaffolding + knowledge, not a hosted bot and not a guaranteed profit machine.
skill/SKILL.md -- a router, not a wall of content.references/safety-rails.md first, then maps your intent to one leaf via the Task Routing Guide.skill/templates/.../solana-dev/.Progressive disclosure keeps context lean: pointers in the router, density in the leaves. The pure math/logic modules (fees.rs, risk.rs) are std-only and self-contained, so they compile and run standalone -- rustc --edition 2021 --test fees.rs. The full crate compiles with cargo build against the pinned crates (needs network to fetch them).
./install.sh # copies the skill + sibling solana-dev into your skills dir
# or, in Claude Code:
/plugin install solana-arb-executorRequires the sibling solana-dev skill (Anchor / IDL / tx-signing plumbing). install.sh places it alongside this one.
Prompt the agent naturally; the router does the rest:
Load-bearing, enforced in every execution template and in rules/no-auto-execute.md:
DRY_RUN=true and REQUIRE_CONFIRM=true.solana-sdk 4.0.1 ("4.0") - solana-client 4.0.0 ("4.0") - yellowstone-grpc-client 13.1.1 ("13.1") - yellowstone-grpc-proto 12.5.0 ("12.5") - jito-sdk-rust 0.3.2 ("0.3", early 0.x -- API may shift; pin and review) - tokio 1 (full) - anyhow 1 - serde 1 (derive) - bincode 1 (pinned 1.x to match jito-sdk-rust) - base64 0.22. Rust toolchain 1.96, edition 2021. Run cargo search <crate> or cargo add <crate> to confirm latest. See skill/references/sdk-versions.md.
MIT (c) 2026 Alexandre Bandarra.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.