Add Solana Agent Firewall submission

submissions/solana-agent-firewall.md

@@ -0,0 +1,48 @@
+# Solana Agent Firewall
+
+Repository: https://github.com/winsznx/solana-agent-firewall
+
+`solana-agent-firewall` is an installable Solana AI Kit skill plus a working CLI and MCP runtime for `is_this_safe(tx)`: a pre-sign transaction firewall for Solana agents.
+
+Instead of auditing only source code before deployment, it checks the serialized transaction an agent is about to sign and returns `ALLOW`, `WARN`, or `BLOCK` with evidence, simulation effects, decoded instruction risks, and policy violations.
+
+## Why It Matters
+
+Autonomous Solana agents need a runtime safety layer before they move funds. A builder can write correct code and still have an agent sign a dangerous transaction from an unknown protocol, stale route, malicious UI, compromised planner, or misleading intent.
+
+This skill protects the signing boundary.
+
+## Fit With Solana AI Kit
+
+- `skill/SKILL.md` entry point with progressive docs for architecture, detectors, simulation, policy, Token-2022 risk, resources, and usage.
+- Optional `agents/` and `commands/` surfaces for agent workflows.
+- `install.sh` copies the skill into a target Solana AI Kit skills directory.
+- MIT licensed.
+- Public repo with README, tests, fixtures, CLI, and MCP server.
+
+## Runtime Surfaces
+
+- CLI: `pnpm firewall check <tx.b64> --rpc-url "$SOLANA_RPC_URL"`
+- MCP: `pnpm mcp`, exposing `firewall_check`
+- Agent demo: `SOLANA_RPC_URL="https://api.mainnet-beta.solana.com" pnpm demo:agent`
+
+## Proofs
+
+- Funded clean SOL transfer fixture returns `ALLOW` with successful simulation and signer delta.
+- Crafted drain transaction returns `BLOCK` for unlimited SPL approval plus close-account rent redirect.
+- Intent mismatch fixture returns `WARN` when a claimed swap actually changes token-account ownership.
+- Real mainnet Jupiter v0 fixture resolves Address Lookup Tables and checks known protocol/program behavior without false critical findings.
+- The skill validates with the official `quick_validate.py` skill validator.
+
+## Core Checks
+
+- Legacy and v0 transactions, including ALT resolution.
+- Simulation deltas for signer SOL/token effects.
+- SPL Token and Token-2022 instruction decoding.
+- Unlimited approvals, authority changes, close-account drains, burns, program upgrades, unknown programs, and priority-fee drain.
+- Token-2022 extension risks: permanent delegate, transfer hook, freeze/default-state risk, transfer fees.
+- Policy caps such as denied programs, unknown-program handling, max SOL outflow, and human approval thresholds.
+
+## Safety Model
+
+The firewall is fail-safe. Missing RPC, unresolved ALTs, failed simulation, unknown programs, or incomplete enrichment produce `WARN` or `BLOCK`, never a silent `ALLOW`.