# plamen

Autonomous Web3 security auditor for Claude Code and OpenAI Codex CLI. Orchestrates 18-100 AI agents across 40+ phases to produce audit reports with verified PoC exploits — for smart contracts and L1 node-client infrastructure.

- Tier: Indexed (plain plugin)
- Category: Security
- Page: https://www.flowy.sh/listings/plamentsv-plamen
- Source: https://github.com/PlamenTSV/plamen
- Price: free and open source

## Summary
plamen is a Claude Code plugin with 160 hand-picked skills for security work, indexed on Flowy. Install it with the command on its page. It includes ability-analysis, bit-shift-safety, centralization-risk. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.

## Install (Claude Code)
```
npx -y skills add PlamenTSV/plamen --agent claude-code
```

## Skills
- ability-analysis
- bit-shift-safety
- centralization-risk
- cross-chain-timing
- dependency-audit
- economic-design-audit
- external-precondition-audit
- flash-loan-interaction
- fork-ancestry
- fungible-asset-security
- migration-analysis
- move-safety-core-directives
- oracle-analysis
- reentrancy-analysis
- ref-lifecycle
- semi-trusted-roles
- share-allocation-fairness
- temporal-parameter-staleness
- token-flow-tracing
- type-safety
- verification-protocol
- zero-state-return
- authorization-model
- choice-semantics
- cid-capability-safety
- contract-key-safety
- economic-design-audit
- ensure-invariants
- locking-semantics
- privacy-disclosure
- semi-trusted-roles
- share-allocation-fairness
- temporal-parameter-staleness
- verification-protocol
- centralization-risk
- cross-chain-message-integrity
- cross-chain-timing
- economic-design-audit
- event-correctness
- external-precondition-audit
- flash-loan-interaction
- fork-ancestry
- migration-analysis
- oracle-analysis
- semi-trusted-roles
- share-allocation-fairness
- staking-receipt-tokens
- storage-layout-safety
- temporal-parameter-staleness
- token-flow-tracing
- verification-protocol
- zero-state-return
- account-abstraction-security
- cross-vm-serialization-conformance
- dex-integration-security
- governance-attack-vectors
- integration-hazard-research
- bls-aggregation-audit
- config-correctness
- consensus-math-correctness
- consensus-safety-invariants
- consensus-tx-identity-invariants
- cosmos-ibc-security
- cosmos-sdk-module-safety
- cross-environment-semantic-drift
- data-availability-enforcement
- dependency-audit-nodeclient
- execution-client-hardening
- fork-choice-audit
- go-concurrency-safety
- gossip-cache-invariance
- hardfork-activation-and-protocol-upgrade
- light-client-proof-verification
- mempool-asymmetric-dos
- p2p-dos-and-eclipse
- peer-scoring-correctness
- rpc-surface-audit
- rust-unsafe-audit
- state-sync-pruning
- validator-lifecycle-and-slashing
- write-error-divergence
- lending-protocol-security
- nft-protocol-security
- outcome-determinism
- vault-accounting
- callback-receiver-safety
- dimensional-analysis
- event-completeness
- multi-step-operation-safety
- semantic-consistency-audit
- semantic-gap-investigator
- signature-verification-audit
- spec-compliance-audit
- stableswap-compliance
- account-lifecycle
- account-validation
- centralization-risk
- cpi-security
- cross-chain-timing
- economic-design-audit
- external-precondition-audit
- flash-loan-interaction
- fork-ancestry
- instruction-introspection
- migration-analysis
- pda-security
- semi-trusted-roles
- share-allocation-fairness
- temporal-parameter-staleness
- token-2022-extensions
- token-flow-tracing
- trident-api-reference
- verification-protocol
- zero-state-return
- auth-validation
- centralization-risk
- contract-upgradeability
- cross-chain-timing
- custom-type-safety
- economic-design-audit
- external-precondition-audit
- flash-loan-interaction
- fork-ancestry
- migration-analysis
- overflow-safety
- semi-trusted-roles
- sep41-token-safety
- share-allocation-fairness
- storage-lifecycle
- temporal-parameter-staleness
- token-flow-tracing
- verification-protocol
- zero-state-return
- ability-analysis
- bit-shift-safety
- centralization-risk
- cross-chain-timing
- dependency-audit
- economic-design-audit
- external-precondition-audit
- flash-loan-interaction
- fork-ancestry
- migration-analysis
- move-safety-core-directives
- object-ownership
- oracle-analysis
- package-version-safety
- ptb-composability
- semi-trusted-roles
- share-allocation-fairness
- temporal-parameter-staleness
- token-flow-tracing
- type-safety
- verification-protocol
- zero-state-return
- plamen-l1-wizard
- plamen-l1
- plamen-wizard
- plamen
- audit-prep

## FAQ

### What is plamen?
Autonomous Web3 security auditor for Claude Code and OpenAI Codex CLI. Orchestrates 18-100 AI agents across 40+ phases to produce audit reports with verified PoC exploits — for smart contracts and L1 node-client infrastructure.

### How do I install plamen?
Run these in Claude Code: npx -y skills add PlamenTSV/plamen --agent claude-code. Then prompt normally.

### Does plamen auto-invoke its skills?
Not yet. It is indexed on Flowy as a plain plugin. Request auto-invocation on its page and Flowy will route its skills for you as you prompt.

### Is plamen free?
Yes. Flowy is free and open source, with nothing gated. You can read every skill in full before you install.