/plamen
Launch the Plamen deterministic Web3 security audit pipeline
$ npx -y skills add PlamenTSV/plamen --skill plamen --agent claude-codeHow it fires
How this skill gets triggered: by you, by Claude, or both.
- Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.Auto-invocation is when the right skill fires by itself at the right moment, driven by a FLOW.md router and a hook, instead of you invoking it by name. It is the difference between a skill being installed and a skill actually getting used.Read the full definition →
- You can call itInvoke it directly when you want it.
- Slash command
/plamen
Context preview
The summary Claude sees to decide when to auto-load this skill.
Launch the Plamen deterministic Web3 security audit pipeline
SKILL.md
plamen.SKILL.mdname: plamen
description: "Launch the Plamen deterministic Web3 security audit pipeline"
Plamen V2 Wizard Launcher For Codex
Use this skill whenever the user invokes `$plamen`, `/plamen`, asks to start, resume, or configure a Plamen audit, or asks for the Plamen wizard inside Codex.
Hard Rule
Do not manually orchestrate Plamen phases. Do not spawn recon, breadth, depth, verification, or report agents yourself. The Python driver is the sole owner of phase sequencing for both Claude and Codex routes.
Your job is the same job as the Claude `/plamen` command wizard:
1. Detect an existing audit and offer resume/fresh/new. 2. Collect missing launch parameters. 3. Write or reuse `{PROJECT_ROOT}/.scratchpad/config.json`. 4. Launch the deterministic driver. 5. Report the resume command and basic status.
For new Codex launches, `config.json` must set `"cli_backend": "codex"`. For existing audits, do not rewrite the config on resume.
Wizard Files
Follow the Codex-native wizard references in this skill directory:
- Smart-contract audits: `plamen-wizard.md`
- L1 infrastructure audits: `plamen-l1-wizard.md`
Read only the relevant file:
- If the user says `l1`, `L1`, `infra`, `client`, `go`, `rust node`, or
the target looks like a chain/client codebase, use `plamen-l1-wizard.md`.
- Otherwise use `plamen-wizard.md`.
Invocation Syntax
$plamen [l1] [light|core|thorough] [path] [docs:<path-or-url>] [scope:<path>] [notes:<text>] [--fresh]
$plamen resume [path-or-config]
Defaults:
- `pipeline`: `sc`
- `mode`: `core`
- `project_root`: current working directory
- `cli_backend`: `codex`
Do not ask a model-selection question from this skill. The user is already running inside the model/backend they chose.
Driver Commands
Codex route:
python C:\\Users\\plmnt\\.codex\\plamen\\scripts\plamen_driver.py "{CONFIG_PATH}"Fresh restart:
python C:\\Users\\plmnt\\.codex\\plamen\\scripts\plamen_driver.py --fresh "{CONFIG_PATH}"Read more
name: plamen description: "Launch the Plamen deterministic Web3 security audit pipeline"
Plamen V2 Wizard Launcher For Codex
Use this skill whenever the user invokes `$plamen`, `/plamen`, asks to start, resume, or configure a Plamen audit, or asks for the Plamen wizard inside Codex.
Hard Rule
Do not manually orchestrate Plamen phases. Do not spawn recon, breadth, depth, verification, or report agents yourself. The Python driver is the sole owner of phase sequencing for both Claude and Codex routes.
Your job is the same job as the Claude `/plamen` command wizard:
1. Detect an existing audit and offer resume/fresh/new. 2. Collect missing launch parameters. 3. Write or reuse `{PROJECT_ROOT}/.scratchpad/config.json`. 4. Launch the deterministic driver. 5. Report the resume command and basic status.
For new Codex launches, `config.json` must set `"cli_backend": "codex"`. For existing audits, do not rewrite the config on resume.
Wizard Files
Follow the Codex-native wizard references in this skill directory:
- Smart-contract audits: `plamen-wizard.md`
- L1 infrastructure audits: `plamen-l1-wizard.md`
Read only the relevant file:
- If the user says `l1`, `L1`, `infra`, `client`, `go`, `rust node`, or
the target looks like a chain/client codebase, use `plamen-l1-wizard.md`.
- Otherwise use `plamen-wizard.md`.
Invocation Syntax
$plamen [l1] [light|core|thorough] [path] [docs:<path-or-url>] [scope:<path>] [notes:<text>] [--fresh] $plamen resume [path-or-config]
Defaults:
- `pipeline`: `sc`
- `mode`: `core`
- `project_root`: current working directory
- `cli_backend`: `codex`
Do not ask a model-selection question from this skill. The user is already running inside the model/backend they chose.
Driver Commands
Codex route:
python C:\\Users\\plmnt\\.codex\\plamen\\scripts\plamen_driver.py "{CONFIG_PATH}"Fresh restart:
python C:\\Users\\plmnt\\.codex\\plamen\\scripts\plamen_driver.py --fresh "{CONFIG_PATH}"Autonomous Web3 security auditor for Claude Code and OpenAI Codex CLI. Orchestrates 18-100 AI agents across 40+ phases to produce audit reports with verified PoC exploits — for smart contracts and L1 node-client infrastructure.
Repo: PlamenTSV/plamen
Other skills on plamen.
- /ability-analysis
Trigger Pattern Always (Aptos Move) - foundational security check - Inject Into Breadth agents, depth agents
Open skill - /bit-shift-safety
Trigger Pattern Always (Aptos Move) - Move VM aborts on shift = bit width - Inject Into Breadth agents, depth-edge-case
Open skill - /centralization-risk
Trigger Protocol has privileged roles (admin, operator, governance, resource account owner) - Covers Single points of failure, privilege escalation, external governance dependen...
Open skill - /cross-chain-timing
Trigger Pattern wormhole|layerzero|ccip|bridge|cross_chain|vaa|guardian|emitter|relay|remote_chain|payload|nonce.sequence - Inject Into Breadth agents, depth-external
Open skill - /dependency-audit
Trigger EXTERNAL_LIB flag detected (protocol uses third-party Move dependencies) - Used by Breadth agents, depth-external
Open skill - /economic-design-audit
Trigger Pattern MONETARY_PARAMETER flag (required) - Inject Into Breadth agents (merged via M4 hierarchy)
Open skill

