Autonomous Web3 security audit agent for Claude Code
This repository also configures its own agents. See what plamen tells them →
Skill Claude CodeCodex
L1 trigger - audits execution engine (EVM interpreter, WASM, SVM) for memory corruption, gas mispricing (EXTCODESIZE class), opcode semantics, and VM invariant breaks.
Skill Claude CodeCodex
L1 trigger - audits fork-choice rule implementation (LMD-GHOST, Tendermint locking, Nakamoto longest-chain) for equivocation handling, slot-vs-block reasoning, duplicate block handling, and chain reorg correctness.
Skill Claude CodeCodex
L1 supplement - audits Go-specific concurrency hazards in node client code: map iteration non-determinism, goroutine leaks, mutex ordering, panic boundaries, context cancellation.
Skill Claude CodeCodex
L1 trigger - audits message and seen caches for write-after-validate ordering, eviction safety, and duplicate handling.
Skill Claude CodeCodex
L1 trigger - audits bugs that surface only at fork boundaries / protocol upgrade points: activation logic, dormant code paths, upgrade epoch correctness, version gating.
Skill Claude CodeCodex
L1 trigger - audits light client and cross-chain proof verification: Merkle proof soundness, ICS-23 subkey handling (Dragonberry class), state root checks, message integrity.
Skill Claude CodeCodex
L1 trigger - audits mempool / transaction pool for eviction asymmetries, replacement policy abuse, blob-pool exhaustion, and DETER-class denial of service.
Skill Claude CodeCodex
L1 trigger - audits peer-to-peer networking for DoS vectors (resource exhaustion, amplification), eclipse attack susceptibility, and discovery table poisoning (Kademlia/devp2p).
Skill Claude CodeCodex
L1 trigger - audits peer reputation and scoring logic for symmetry, farming resistance, and penalty coverage.
Skill Claude CodeCodex
L1 trigger - audits JSON-RPC and Engine API surfaces for authentication bypass, rate limiting, subscription buffer overflows, and method-specific DoS.
Skill Claude CodeCodex
L1 supplement - audits Rust-specific hazards: unsafe blocks, uninitialized memory, Send/Sync violations, panic safety in hot paths, drop order, FFI.
Skill Claude CodeCodex
L1 trigger - audits state sync, snapshot integrity, checkpoint trust, pruning race conditions, and state growth attacks.
Skill Claude CodeCodex
L1 trigger - audits validator entry/exit transitions, slashing correctness, leader-duplicate handling, and lifecycle state invariants for PoS / DPoS / BFT consensus clients.
Skill Claude CodeCodex
L1 trigger - audits file/database write paths for metadata commits, cache updates, and success returns that diverge when writes fail.
Skill Claude CodeCodex
Protocol Type Trigger lending (detected when recon finds liquidate|borrow|repay|collateral|lend|loan|LTV|healthFactor|interestRate|debtToken) - Inject Into Breadth agents, depth...
Skill Claude CodeCodex
Protocol Type Trigger nft (detected when ERC721/ERC1155 with marketplace, minting, staking, or collateral logic found) - Inject Into Breadth agents, depth-token-flow, depth-edge...
Skill Claude CodeCodex
Protocol Type Trigger outcomedeterminism - detected when EITHER of these code patterns are present - - Selection from finite depletable pool with fallback behavior (while(full)...
Skill Claude CodeCodex
Protocol Type Trigger vault (detected in recon TASK 0 Step 1) - Inject Into Core state agent OR economic design agent (merge via M4 hierarchy).
Skill Claude CodeCodex
Niche agent for callback receiver safety: access control on implemented callback handlers, permissionless state inflation via callbacks, and selective revert exploitation.
Skill Claude CodeCodex
Trigger MIXEDDECIMALS flag (mulDiv/mulWad/rayMul + mixed scale factors detected) - standalone niche agent, 1 budget slot.
Skill Claude CodeCodex
Trigger MISSINGEVENT flag in templaterecommendations.md (recon detects admin/state-changing functions without events) - Agent Type general-purpose (standalone niche agent, NOT...
Skill Claude CodeCodex
Niche agent for multi-step operation safety: authorization sequence conflicts in batch/multi-step operations, and infrastructure address targeting via public on-behalf-of functions.
Skill Claude CodeCodex
Trigger HASMULTICONTRACT flag in templaterecommendations.md (recon detects 2+ in-scope contracts/modules sharing parameters or formulas) - Agent Type general-purpose (standal...
Skill Claude CodeCodex
Trigger Semantic Invariant Agent (Phase 4a.5) reports syncgaps = 1 OR accumulationexposures = 1 OR conditionalwrites = 1 OR clustergaps = 1 in its return message - Agent Typ...
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: