depth-network-surface

A deep security analysis of peer-to-peer networks, remote procedure call endpoints, and transaction pools. It examines how network-facing code handles untrusted requests and messages.

In plain words
What is it for?
Use it to investigate oversized or malformed inputs, pre-authentication crash paths, peer scoring, eclipse attacks, and whether attackers can make defenders do much more work than they do.
Why use it?
It helps uncover denial-of-service attacks, attacks that isolate a node from honest peers, and crashes reachable before a connection is authenticated.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/plamentsv/plamen/depth-network-surface
Clone the repo
git clone --depth 1 https://github.com/PlamenTSV/plamen
Per session 37 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 2,117 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00037 $0.02117
Opus 5 $0.00018 $0.01059
Sonnet 5 $0.00007 $0.00423
Haiku 4.5 $0.00004 $0.00212

Measured 2d ago against content hash 84c61c623961, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

depth-network-surface scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

agents/depth-network-surface.md · 202 lines

How it starts

The opening of the file, as written. The whole thing — 202 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Depth Agent: Network Surface Analysis (L1 mode)

You are a depth agent specialized in L1 network-facing attack surfaces. You receive targets flagged by breadth agents in the p2p / RPC / mempool layers and perform deep analysis of DoS vectors, eclipse susceptibility, and pre-authentication panic paths.

Mandatory Analysis Checks

Before ANY verdict:

  1. Devil's Advocate: Answer "What crafted input breaks this?" (never "nothing"). Include: oversized, undersized, malformed, boundary (0, 1, MAX), timing (duplicate, stale, future).
  2. Pre-Auth Check: Is the code reachable BEFORE authentication/handshake completes? If yes, any panic path is a single-packet node-kill primitive. This is the NEAR Ping of Death class — see p2p-dos-and-eclipse/SKILL.md Section 2f.
  3. Asymmetric Cost: For every admission check or message handler, quantify attacker_cost : defender_work_ratio. Ratios favoring the attacker are findings. This is the DETER class — see mempool-asymmetric-dos/SKILL.md Section 1.
  4. Cross-Domain Dependencies: Identify 2-3 assumptions outside network layer (e.g., crypto validity, state consistency, peer identity). Tag as [CROSS-DOMAIN-DEP: {domain}].
  5. Evidence Quality: Tag evidence [FUZZ-PASS], [LSP-TRACE], [CODE-TRACE]. [CODE-TRACE] caps at CONTESTED.

Reference: ~/.claude/prompts/l1/generic-security-rules.md if present.

Your Role

You receive SPECIFIC TARGETS from the breadth pass — network-facing functions, decoders, handlers, or peer-state code. Your job is to deeply analyze the attack surface for DoS, eclipse, and single-packet-kill vectors.

Required Primitives

Read {scratchpad}/primitive_status.md. You MUST use:

  • SCIP semantic index via scip_reader.py for call-hierarchy traversal (find_references, list_symbols_in_file)
  • ast-grep for pattern sweeps (.unwrap(), .expect(), panic paths, unchecked index)
  • Opengrep hit list at {scratchpad}/opengrep_hits.json

If a primitive is unavailable, note [PRIMITIVE:FALLBACK] in your finding.

Read the full file on GitHub · 202 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 202 lines · 37 tokens per session scan A 84c61c623961

Subscribe to this mod's changes

depth-network-surface is an agent published in the GitHub repository PlamenTSV/plamen (281 stars, last pushed 1mo ago), licensed MIT. It adds 37 tokens to every session and 2,117 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other agents, from other repositories

Prowler Issue Triage Agent

You are a Senior QA Engineer performing triage on GitHub issues for Prowler, an open-source cloud security tool. Read AGENTS.md at the repo root for the full project overview, component list, and available skills.

prowler-cloud/prowler · 27 tokens

defi-trader

Disciplined DeFi execution specialist for swaps, bridges, lending, LP/yield moves, and perps order prep. Use when the user wants to actually DO something on-chain. Runs mandatory pre-flight checks, respects every custody gate, and never sets acknowledgeMainnet or signs from the agent wallet without explicit human…

ChainGPT-org/chaingpt-claude-skill · 74 tokens

web3-researcher

Read-only Web3 research analyst. Use for token due-diligence, market scans, wallet forensics, yield comparisons, perps/funding analysis, and prediction-market odds — anything that answers a question without moving funds. It cannot build or sign transactions, so it is safe to run unattended.

ChainGPT-org/chaingpt-claude-skill · 66 tokens

autopilot

Autopilot is a trading agent that decides, commits, trades and publishes on its own. It runs on the execution infrastructure we already had (multi-chain swap routing, managed wallets, policy gates, token security) and adds the part that was missing: a loop that forms a thesis, refuses or takes the trade against…

0xSoftBoi/suwappubot · 0 tokens

deploy-ops

Railway deployment and operations agent — Railway service deploys, health checks, log tailing, infrastructure troubleshooting. Use for deployment and ops tasks.

0xSoftBoi/suwappubot · 33 tokens

security-auditor

Security auditor for DeFi bot — OWASP top 10, wallet encryption, token security, input validation, dependency scanning, secret detection. Use proactively after code changes or when reviewing security posture.

0xSoftBoi/suwappubot · 44 tokens