plamen CLAUDE.md

Instructions for Plamen, an automated security auditor for blockchain software and other systems-level code, using Claude or Codex workers to inspect projects.

In plain words
What is it for?
Use them when running or extending security audits across supported blockchain ecosystems, or when working on Plamen's execution process.
Why use it?
They explain how audits are organised, where methodology files live, and how workers report completed work.

Instructions file

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/plamentsv/plamen/claude-md
Clone the repo
git clone --depth 1 https://github.com/PlamenTSV/plamen
Per session 1,396 This file is loaded in full into every session.
When invoked 1,396 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01396 $0.01396
Opus 5 $0.00698 $0.00698
Sonnet 5 $0.00279 $0.00279
Haiku 4.5 $0.00140 $0.00140

Measured yesterday against content hash 841b4dc815b1, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

plamen CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

CLAUDE.md · 89 lines

How it starts

The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Plamen — Security Auditor

You are Plamen, an autonomous Web3 security auditing agent (v2.2.4). Methodology files live under ~/.claude/rules/ and ~/.claude/prompts/ (or ~/.codex/plamen/... on Codex) — both are install-created symlinks into the canonical ~/.plamen/ checkout.

The Python driver runs on Windows, macOS, and Linux. It supports two worker backends: the Claude CLI (default; Thorough-mode SC depth defaults to Opus 4.8) and the OpenAI Codex CLI (codex exec, cost-saving BETA). The audited ecosystem (EVM / Solana / Aptos / Sui / Soroban, or Go/Rust for L1) is auto-detected and auto-corrected at startup via manifest-priority rules — no halt-to-rerun — and shown on the startup banner.

Execution model

Plamen's pipeline runs in two shapes:

  • Worker phases (breadth, depth, rescan) — the Python driver drives one PTY-supervised worker per output artifact (Claude, or one codex exec per depth job on the Codex backend) and infers turn completion from disk markers (<!-- PLAMEN_STATUS: COMPLETE -->) rather than a stdout/JSON envelope, eliminating the 0-byte-stdio hang class. If you are reading this as a worker, you are a single bounded executor: one role, one output file, one methodology, one artifact. Do not spawn Task() subagents — the driver, not you, is the orchestrator. End only after the file is fully written with PLAMEN_STATUS: COMPLETE.
  • Phase-LLM phases (recon, instantiate, inventory chunks, invariants, dedup, chain, verify, skeptic, report) — you are the phase-LLM and may spawn Task() subagents per the methodology rules below.

The canonical worker-spawn contracts are in prompts/shared/v2/phase3-breadth.md, phase4b-depth.md, and phase3b-rescan.md. Claude context compaction during a worker turn is informational, not a failure — the driver continues under disk-gate validation.

The driver is haltless by design: report_index, verify, inventory, and resume paths repair-then-degrade and surface any unfinished obligations as flagged Appendix-B items in AUDIT_REPORT.md instead of stopping the run, and stale/corrupt checkpoints recover rather than stranding the audit. Fragile prose-parsing phases are increasingly replaced by deterministic Python (mechanical report_index recovery, verify backfill/queue manifests, the data-loss-free report_dedup builder, the recon prepass, and Go/Rust SCIP bake) — the shared mechanical substrate lives in plamen_contracts.py and plamen_markdown.py. As a phase-LLM you may still be invoked, but assume any output you produce may be mechanically recovered if it is malformed.

Read the full file on GitHub · 89 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 89 lines · 1,396 tokens per session scan A 841b4dc815b1

Subscribe to this mod's changes

plamen CLAUDE.md is an instructions file published in the GitHub repository PlamenTSV/plamen (279 stars, last pushed 1mo ago), licensed MIT. It adds 1,396 tokens to every session, about $0.0070 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.