plamentsv/plamen
codex-adapter/skills/plamen/SKILL.md
Launch the Plamen deterministic Web3 security audit pipeline
$ install --global
skillsauthnpx skillsauth add plamentsv/plamen plamenInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 5, 2026, 5:26 AM42.6s1 file scanned
SKILL.md
- name:
- plamen
- description:
- Launch the Plamen deterministic Web3 security audit pipeline
Plamen V2 Wizard Launcher For Codex
Use this skill whenever the user invokes $plamen, /plamen, asks to
start, resume, or configure a Plamen audit, or asks for the Plamen wizard
inside Codex.
Hard Rule
Do not manually orchestrate Plamen phases. Do not spawn recon, breadth, depth, verification, or report agents yourself. The Python driver is the sole owner of phase sequencing for both Claude and Codex routes.
Your job is the same job as the Claude /plamen command wizard:
- Detect an existing audit and offer resume/fresh/new.
- Collect missing launch parameters.
- Write or reuse
{PROJECT_ROOT}/.scratchpad/config.json. - Launch the deterministic driver.
- Report the resume command and basic status.
For new Codex launches, config.json must set "cli_backend": "codex".
For existing audits, do not rewrite the config on resume.
Wizard Files
Follow the Codex-native wizard references in this skill directory:
- Smart-contract audits:
plamen-wizard.md - L1 infrastructure audits:
plamen-l1-wizard.md
Read only the relevant file:
- If the user says
l1,L1,infra,client,go,rust node, or the target looks like a chain/client codebase, useplamen-l1-wizard.md. - Otherwise use
plamen-wizard.md.
Invocation Syntax
$plamen [l1] [light|core|thorough] [path] [docs:<path-or-url>] [scope:<path>] [notes:<text>] [--fresh]
$plamen resume [path-or-config]
Defaults:
pipeline:scmode:coreproject_root: current working directorycli_backend:codex
Do not ask a model-selection question from this skill. The user is already running inside the model/backend they chose.
Driver Commands
Codex route:
python C:\\Users\\plmnt\\.codex\\plamen\\scripts\plamen_driver.py "{CONFIG_PATH}"
Fresh restart:
python C:\\Users\\plmnt\\.codex\\plamen\\scripts\plamen_driver.py --fresh "{CONFIG_PATH}"
Related Skills
plamentsv/fork-ancestry
data-ai
VerifiedTrustedCommunity
Trigger Pattern Always (run during recon TASK 0, not breadth) - Inject Into Recon agent only (meta_buffer.md enrichment)
263SKILL.mdUpdated May 14, 2026
plamentsv/fork-ancestry
data-ai
VerifiedTrustedCommunity
Trigger Pattern Always (run during recon TASK 0, not breadth) - Inject Into Recon agent only (meta_buffer.md enrichment)
263SKILL.mdUpdated May 14, 2026
plamentsv/fork-ancestry
data-ai
VerifiedTrustedCommunity
Trigger Pattern Always (run during recon TASK 0, not breadth) - Inject Into Recon agent only (meta_buffer.md enrichment)
263SKILL.mdUpdated May 14, 2026
plamentsv/stableswap-compliance
data-ai
VerifiedTrustedCommunity
Trigger STABLESWAP_FORK flag (fork-ancestry detects Curve/StableSwap parent via get_d/get_y/ramp_a/StableSwap patterns) - Agent Type general-purpose (standalone niche agent, 1 budget slot)
263SKILL.mdUpdated May 14, 2026