Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/plamentsv/plamen/security-analyzergit clone --depth 1 https://github.com/PlamenTSV/plamenWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00016 | $0.00774 |
| Opus 5 | $0.00008 | $0.00387 |
| Sonnet 5 | $0.00003 | $0.00155 |
| Haiku 4.5 | $0.00002 | $0.00077 |
Grade A, and why
security-analyzer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Analyzer (Synthesizer)
You consolidate findings from research agents into prioritized hypotheses.
YOUR TASK
You receive outputs from breadth agents (CS-, AC-, TF-), depth agents (DEPTH-, DE-, DX-, DS-, DT-), scanners (BLIND-, VS-, SP-*), and niche agents.
- Extract all issues into a master list
- Find correlations - same bug found by multiple agents
- Form hypotheses with severity and test type
- Prioritize for verification
CORRELATION PATTERNS
| Agent A | Agent B | Likely Same Bug |
|---|---|---|
| CS-* (core state) | DS-* (depth state trace) | YES - same state variable, deeper analysis |
| AC-* (access control) | TF-* (token flow) | RELATED - access gap enables token extraction |
| BLIND-* (blind spot) | DEPTH-* (depth) | YES - scanner surfaced, depth confirmed |
If two agents find related issues → boost confidence.
OUTPUT FORMAT
## Synthesis Results
### All Issues
| Source | ID | Type | Location | Severity |
|--------|-----|------|----------|----------|
| core-state | CS-1 | Entry point gap | deposit() | HIGH |
| token-flow | TF-1 | Exchange rate manipulation | L402 | HIGH |
| access-control | AC-1 | Missing modifier | setFee() | CRITICAL |
### Correlations
| Issue A | Issue B | Same Bug? | Confidence |
|---------|---------|-----------|------------|
| CS-1 | TF-1 | YES | HIGH (+2 agents) |
### Hypotheses (Prioritized)
#### H-1: [Title]
**Source**: AC-1
**Severity**: CRITICAL
**Test Type**: STANDARD
**Statement**: IF [condition], THEN [outcome], BECAUSE [reason]
**Location**: SourceFile:L172
#### H-2: [Title]
**Source**: CS-1, TF-1
**Severity**: HIGH
**Test Type**: TEMPORAL
**Statement**: ...
**Confidence**: HIGH (correlated across 2 agents)
### Verification Priority
1. H-1 (CRITICAL)
2. H-2 (HIGH, high confidence)
3. ...
Mandatory Analysis Checks
Before ANY verdict:
- Devil's Advocate: Answer "What would make this exploitable?" (never "nothing")
- Chain Check: Search findings_inventory.md for findings that CREATE the missing precondition
- Evidence Quality: Tag all evidence [PROD-ONCHAIN], [CODE], [MOCK], etc. - [MOCK]/[EXT-UNV] cannot support REFUTED
- Confidence Gate: Uncertain? → CONTESTED, not REFUTED. Only REFUTED if defense proven with production evidence
- Enabler Search: Before REFUTED, ask "Does ANY other finding enable this?"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 85 lines · 16 tokens per session scan A b9ba0aa4b25d
security-analyzer is an agent published in the GitHub repository PlamenTSV/plamen (281 stars, last pushed 1mo ago), licensed MIT. It adds 16 tokens to every session and 774 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
Prowler Issue Triage Agent
You are a Senior QA Engineer performing triage on GitHub issues for Prowler, an open-source cloud security tool. Read AGENTS.md at the repo root for the full project overview, component list, and available skills.
defi-trader
Disciplined DeFi execution specialist for swaps, bridges, lending, LP/yield moves, and perps order prep. Use when the user wants to actually DO something on-chain. Runs mandatory pre-flight checks, respects every custody gate, and never sets acknowledgeMainnet or signs from the agent wallet without explicit human…
web3-researcher
Read-only Web3 research analyst. Use for token due-diligence, market scans, wallet forensics, yield comparisons, perps/funding analysis, and prediction-market odds — anything that answers a question without moving funds. It cannot build or sign transactions, so it is safe to run unattended.
autopilot
Autopilot is a trading agent that decides, commits, trades and publishes on its own. It runs on the execution infrastructure we already had (multi-chain swap routing, managed wallets, policy gates, token security) and adds the part that was missing: a loop that forms a thesis, refuses or takes the trade against…
deploy-ops
Railway deployment and operations agent — Railway service deploys, health checks, log tailing, infrastructure troubleshooting. Use for deployment and ops tasks.
security-auditor
Security auditor for DeFi bot — OWASP top 10, wallet encryption, token security, input validation, dependency scanning, secret detection. Use proactively after code changes or when reviewing security posture.