ARGUS-R Solana Security Research

ARGUS-R is a Solana security research framework delivered as a portable skill for authorized, evidence-driven research on programs, SDKs, keepers, and trust-boundary dependencies. It bundles the ARGUS-R claim method, an offline case ledger, and a pinned Solana Security Standard snapshot.

Use

Give the complete skill folder, repository, or archive to Codex or Claude Code—or use that client's normal skill installer. Keep the whole folder together: SKILL.md links to bundled references, scripts, prompts, and metadata that are part of the skill.

Then ask the agent naturally, for example:

Use ARGUS-R for authorized local security research on the Solana program in /absolute/path/to/target at its current revision. Scope only that target and its in-repository SDK; do not use public networks or credentials.

Direct invocation is also available after the host discovers the skill:

• Codex: $argus-r-security-research
• Claude Code: /argus-r-security-research

The host agent handles case creation, selects only the tools and research responsibilities needed for the request, and remains bound by its current model, permissions, and tooling. ARGUS-R does not require a custom installer, hooks, MCP or RPC setup, wallet setup, client selector, model pin, custom agent profiles, or scanner installation.

The agent needs Python 3.10+ on macOS, Linux, or WSL for the bundled ledger; no third-party Python packages are required. New cases default to the private user location ~/.argus-r/cases, outside the target repository.

Method and safety

ARGUS-R maps Solana instructions, accounts, CPI edges, state transitions, deployment assumptions, and target-specific invariants before promoting claims. It uses the bundled SOL-001–SOL-052 material as a coverage lens; scans and checklists are evidence inputs, never proof of safety or impact. The optional scanner is not required and its npm dependencies are not bundled.

Work only within the user's exact authorization. Default to isolated local fixtures: no public scanning, keys, deployed-target exploitation, or disclosure. See agent compatibility, bundle provenance, and security policy.

Offline checks validate the portable format, relocated ledger behavior, claim gates, links, and bundled hashes. They do not test a live Codex or Claude Code session and do not constitute an audit of a Solana program.

Argus-R is MIT licensed. The bundled Solana Security Standard retains its upstream copyright and license.