Agent skill

Cross Chain Timing

MITAuto-check passed

Install Cross Chain Timing

skills CLI

$ npx skills add PlamenTSV/plamen --skill cross-chain-timing -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI

$ gh skill install PlamenTSV/plamen cross-chain-timing --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy

$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .claude/skills && cp -r skills-src/agents/skills/solana/cross-chain-timing .claude/skills/cross-chain-timing && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Paste into Claude Code

Install the "cross-chain-timing" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/solana/cross-chain-timing into .claude/skills/cross-chain-timing/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cross-chain-timing", then confirm the skill loads.

Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

$skill-installer

$skill-installer install https://github.com/PlamenTSV/plamen/tree/main/agents/skills/solana/cross-chain-timing

Type this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.

skills CLI

$ npx skills add PlamenTSV/plamen --skill cross-chain-timing -a codex

Project install goes to .agents/skills/; add -g for ~/.codex/skills/.

GitHub CLI

$ gh skill install PlamenTSV/plamen cross-chain-timing --agent codex

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .agents/skills && cp -r skills-src/agents/skills/solana/cross-chain-timing .agents/skills/cross-chain-timing && rm -rf skills-src

Use ~/.agents/skills/ instead of .agents/skills for a personal install.

Codex skills documentation · loads skills from .agents/skills/

Paste into Codex

Install the "cross-chain-timing" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/solana/cross-chain-timing into .agents/skills/cross-chain-timing/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cross-chain-timing", then confirm the skill loads.

Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add PlamenTSV/plamen --skill cross-chain-timing -a cursor

Project install goes to .agents/skills/; add -g for ~/.cursor/skills/.

GitHub CLI

$ gh skill install PlamenTSV/plamen cross-chain-timing --agent cursor

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/agents/skills/solana/cross-chain-timing .cursor/skills/cross-chain-timing && rm -rf skills-src

Use ~/.cursor/skills/ instead of .cursor/skills for a personal install.

Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/

Paste into Cursor

Install the "cross-chain-timing" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/solana/cross-chain-timing into .cursor/skills/cross-chain-timing/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cross-chain-timing", then confirm the skill loads.

Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

gemini skills install

$ gemini skills install https://github.com/PlamenTSV/plamen.git --path agents/skills/solana/cross-chain-timing

--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.

skills CLI

$ npx skills add PlamenTSV/plamen --skill cross-chain-timing -a gemini-cli

Project install goes to .agents/skills/; add -g for ~/.gemini/skills/.

GitHub CLI

$ gh skill install PlamenTSV/plamen cross-chain-timing --agent gemini-cli

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/agents/skills/solana/cross-chain-timing .gemini/skills/cross-chain-timing && rm -rf skills-src

Use ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.

Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/

Paste into Gemini CLI

Install the "cross-chain-timing" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/solana/cross-chain-timing into .gemini/skills/cross-chain-timing/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cross-chain-timing", then confirm the skill loads.

Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

GitHub CLI

$ gh skill install PlamenTSV/plamen cross-chain-timing

Installs for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).

skills CLI

$ npx skills add PlamenTSV/plamen --skill cross-chain-timing -a github-copilot

Project install goes to .agents/skills/; add -g for ~/.copilot/skills/.

Manual copy

$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .github/skills && cp -r skills-src/agents/skills/solana/cross-chain-timing .github/skills/cross-chain-timing && rm -rf skills-src

Use ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.

GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/

Paste into GitHub Copilot

Install the "cross-chain-timing" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/solana/cross-chain-timing into .github/skills/cross-chain-timing/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cross-chain-timing", then confirm the skill loads.

GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

skills CLI

$ npx skills add PlamenTSV/plamen --skill cross-chain-timing -a opencode

OpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.

GitHub CLI

$ gh skill install PlamenTSV/plamen cross-chain-timing --agent opencode

Project scope by default (.agents/skills/); add --scope user for a personal install.

Manual copy

$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/agents/skills/solana/cross-chain-timing .opencode/skills/cross-chain-timing && rm -rf skills-src

Use ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.

OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/

Paste into OpenCode

Install the "cross-chain-timing" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/solana/cross-chain-timing into .opencode/skills/cross-chain-timing/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "cross-chain-timing", then confirm the skill loads.

OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.

Facts

Skill name: cross-chain-timing
GitHub stars: 303
Token cost: ~3.4k tokens
SKILL.md length: 1,340 words
Files: 1
Skills in repo: 87
Repo updated: Sep 26, 2026
First seen: Oct 7, 2026
Licence: MIT

At a glance

Works in 7 steps: Identify Cross-Chain Messaging… → Cross-Chain Message Verification Audit → Timing Window Analysis → …
Pattern wormhole|allbridge|debridge|bridge|crosschain|vaa|guardian|emitter|LayerZero|CCIP|nonce.sequence|relay - Inject Into Breadth agents
SKILL.md covers Step 1: Identify Cross-Chain…, Step 2: Cross-Chain Message…, Step 3: Timing Window Analysis and Step 4: Account Creation…, plus 8 more sections
Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Its SKILL.md is about 3.4k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It works with Solana. The repository describes itself as: Autonomous Web3 security audit agent for Claude Code. The licence is MIT.

When your agent uses it

Pattern wormhole|allbridge|debridge|bridge|crosschain|vaa|guardian|emitter|LayerZero|CCIP|nonce.sequence|relay - Inject Into Breadth agents

Example prompts

“/cross-chain-timing”

Workflow steps

7 steps, taken from the step headings in SKILL.md.

Identify Cross-Chain Messaging Infrastructure
Cross-Chain Message Verification Audit
Timing Window Analysis
Account Creation Requirements
Nonce and Sequence Management
Cross-Chain Price Relay Audit
Quantify Arbitrage Viability

What it can do on your machine

Read from SKILL.md and the folder at commit 795962b. It shows what the files ask for, not the result of running them.

Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Cross Chain Timing loads about 3.4k tokens when it runs. Until then it costs about 46 tokens; SKILL.md has 1,340 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it: ~46
When it runs · the whole SKILL.md, loaded when a task matches: ~3.4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from PlamenTSV/plamen at commit 795962b, republished under its MIT licence (© PlamenTSV). 1,340 words, ~3,441 tokens.

Download SKILL.mdSave it as .claude/skills/cross-chain-timing/SKILL.md (or your agent's skills folder).

name: cross-chain-timing
description: Trigger Pattern wormhole|allbridge|debridge|bridge|cross_chain|vaa|guardian|emitter|LayerZero|CCIP|nonce.sequence|relay - Inject Into Breadth agents, depth-external

CROSS_CHAIN_TIMING Skill (Solana)

Trigger Pattern: wormhole|allbridge|debridge|bridge|cross_chain|vaa|guardian|emitter|LayerZero|CCIP|nonce.*sequence|relay Inject Into: Breadth agents, depth-external Finding prefix: [CCT-N] Rules referenced: R1, R2, R4, R8, R10, R16

Covers: cross-chain message verification, timing asymmetry between Solana and other chains, account creation requirements, nonce/sequence replay protection, and cross-chain price relay staleness.

Solana's fast finality (~400ms optimistic, ~30s confirmed/rooted) creates a fundamental timing asymmetry with slower chains (Ethereum ~12min, rollups 10-60min). This asymmetry is the primary attack vector for cross-chain timing exploits on Solana.

Step 1: Identify Cross-Chain Messaging Infrastructure

Find all cross-chain messaging calls and infrastructure:

#	Bridge/Protocol	Direction	Solana Instruction	Remote Chain	Message Type
1	{Wormhole/Allbridge/deBridge/custom}	{Solana->Remote / Remote->Solana}	{instruction name}	{Ethereum/Arbitrum/etc.}	{token transfer / state sync / price relay / governance}

Wormhole-Specific Inventory

If Wormhole is detected:

Component	Instruction/Account	Purpose	Location
VAA Verification	`verify_signatures` + `post_vaa`	Guardian signature verification	{file:line}
Message Posting	`post_message`	Send message from Solana	{file:line}
Token Bridge	`complete_transfer` / `create_wrapped`	Token bridging	{file:line}
Emitter Account	PDA (emitter seeds)	Message source identity	{file:line}

Allbridge/deBridge-Specific Inventory

If Allbridge or deBridge detected:

Component	Account/Instruction	Verification Method	Location
Message Account	{account type}	{signature/merkle/optimistic}	{file:line}
Relayer	{relayer constraint}	{how relayer is validated}	{file:line}
Nonce Tracking	{nonce account}	{replay prevention method}	{file:line}

Step 2: Cross-Chain Message Verification Audit

For EACH inbound cross-chain message consumed by the program:

2a. Wormhole VAA Verification Checklist

#	Check	Status	Location	Notes
1	Guardian signature count >= quorum (13/19)	YES/NO	{line}	Check: does protocol verify `vaa.guardian_set_index` is current?
2	Guardian set is current (not expired)	YES/NO	{line}	Old guardian sets may be compromised
3	Emitter chain ID validated	YES/NO	{line}	Reject messages from unexpected source chains
4	Emitter address validated	YES/NO	{line}	Reject messages from unexpected contracts on source chain
5	Sequence number replay check	YES/NO	{line}	Each VAA sequence should be processed exactly once
6	Consistency level validated	YES/NO	{line}	`finalized` vs `confirmed` - determines security guarantee
7	Payload format validated	YES/NO	{line}	Malformed payload handling
8	VAA account owner is Wormhole program	YES/NO	{line}	Prevents fake VAA account substitution

Critical: Missing checks 1-5 = CRITICAL (arbitrary cross-chain message injection). Missing checks 6-8 = HIGH (message quality/integrity issues).

2b. Generic Bridge Verification

For non-Wormhole bridges:

#	Check	Status	Location
1	Message source authenticated (signatures/proofs)	YES/NO	{line}
2	Source chain ID validated	YES/NO	{line}
3	Source contract/address validated	YES/NO	{line}
4	Replay protection (nonce/sequence/bitmap)	YES/NO	{line}
5	Message freshness (timestamp/block check)	YES/NO	{line}
6	Relayer authorization (if applicable)	YES/NO	{line}

Step 3: Timing Window Analysis

3a. Finality Asymmetry Model

Chain	Optimistic Finality	Confirmed Finality	Protocol Assumes
Solana	~400ms (processed)	~30s (rooted/finalized)	{which level?}
{Remote Chain}	{time}	{time}	{which level?}
Asymmetry Window	-	-	{max delay between chains}

Critical question: When Solana processes a message about remote chain state, how old can that state be? Compute: max_staleness = remote_finality + bridge_relay_delay + solana_processing_time

3b. Stale State Usage Trace

For each piece of state synced cross-chain:

State Variable	Source Chain	Sync Trigger	Max Staleness	Solana Functions Using It	Fresh Required?
{state}	{chain}	{event/periodic/manual}	{time estimate}	{list instructions}	YES/NO

For each dependent instruction on Solana:

Is fresh state required or is stale acceptable?
What decisions are made with potentially stale data?
Can an attacker exploit the staleness window?

3c. Solana-to-Remote Timing Attack

Solana's fast finality means actions on Solana are visible almost immediately, but take time to propagate to remote chains:

1. Attacker acts on Solana (visible in ~400ms)
2. Solana message posted via bridge (begins relay)
3. TIMING WINDOW: Remote chain does not yet know about Solana action
4. Attacker acts on remote chain using pre-Solana-action state
5. Bridge message arrives on remote chain - state updates
6. Attacker profited from acting on both chains during asymmetry

3d. Remote-to-Solana Timing Attack

1. State changes on remote chain (e.g., price moves, governance action)
2. Bridge message relay begins (latency: {estimate})
3. TIMING WINDOW: Solana still uses old remote state
4. Attacker acts on Solana using stale remote state
5. Bridge message arrives on Solana - state updates
6. Attacker profited from Solana action with stale state

Step 4: Account Creation Requirements

Cross-chain operations on Solana have unique account requirements:

#	Check	Status	Notes
1	Recipient token account exists (ATA) before transfer arrival?	YES/NO	If NO: who creates it? Who pays rent?
2	`init_if_needed` used for receiver accounts?	YES/NO	If YES: check for re-initialization risk
3	What happens if recipient account does not exist?	{revert/skip/queue}	Reverted transfers may be lost
4	Can attacker close recipient ATA before message arrives?	YES/NO	Token account close + re-create with different owner
5	Are PDAs used for cross-chain escrow?	YES/NO	Check PDA seed uniqueness per message
6	Is there a recovery mechanism for failed deliveries?	YES/NO	Lost funds if no recovery

Critical Solana pattern: Cross-chain token transfers require the destination ATA to exist. If it does not:

Some bridges revert and the tokens are stuck on the source chain
Some bridges create the ATA (who pays rent-exempt minimum?)
Some bridges queue the transfer for later claim (is the queue unbounded?)

Step 5: Nonce and Sequence Management

#	Check	Status	Location	Notes
1	Replay protection exists	YES/NO	{line}	Method: {bitmap/counter/hash set/PDA per message}
2	Replay check is BEFORE state changes	YES/NO	{line}	If after: partial replay possible
3	Out-of-order messages handled	YES/NO	{line}	Strict ordering vs any-order processing
4	Sequence gaps handled	YES/NO	{line}	What if message N+1 arrives before N?
5	Nonce account sized for growth	YES/NO	{line}	Bitmap may run out of space
6	Double-spend across chains	YES/NO	{line}	Same asset spent on both chains during relay

Solana replay patterns:

PDA per message: Derive PDA from message hash/sequence. If PDA exists, already processed. Reliable but creates many accounts.
Bitmap account: Store processed sequences as bits. Space-efficient but must handle bitmap growth.
Counter: Only process sequence N if N-1 was processed. Enforces ordering but blocks on gaps.

Show full SKILL.md (515 more words)Show less

Step 6: Cross-Chain Price Relay Audit

If oracle prices are relayed cross-chain:

#	Check	Status	Notes
1	Price freshness validated on Solana side	YES/NO	Max acceptable age?
2	Price source authenticated	YES/NO	Can fake price be relayed?
3	Price deviation bounds	YES/NO	Max delta from last known price?
4	Fallback if relay is delayed/offline	YES/NO	What happens to price-dependent operations?
5	Flash loan on source chain can manipulate relayed price	YES/NO	Is source chain price spot or TWAP?

Staleness calculation: relay_staleness = source_price_age + bridge_latency + solana_processing

If relay_staleness > acceptable_threshold at worst case, price is stale. Apply Rule 16 (Oracle Integrity).

Step 7: Quantify Arbitrage Viability

1. Attacker monitors {SOURCE_CHAIN} for state changes at {MONITOR_POINT}
2. State change triggers sync message (latency window opens: {LATENCY_ESTIMATE})
3. Attacker executes on Solana at {EXPLOIT_INSTRUCTION} using stale {STALE_STATE}
4. Sync message arrives, state updates on Solana
5. Profit = {PROFIT_FORMULA}
6. Cost = bridge_fees + Solana_tx_fees + capital_lockup_cost + Jito_tip
7. Viable if: profit > cost AND repeatable

Solana cost model: Solana transaction fees are very low (~5000 lamports base + priority fee). The primary cost is capital lockup and bridge fees, not gas. This makes small-margin attacks more viable on Solana than EVM.

Key Questions (must answer all)

What is the realistic sync latency for {BRIDGE_PROTOCOL}? (cite documentation)
Can an attacker monitor the remote chain and front-run sync on Solana? (Solana's low fees make this cheap)
What is the maximum state change during normal operation within the sync window?
Is this attack repeatable or one-time?
Are recipient accounts pre-created, or must they be created on arrival?
Is replay protection complete (covers all message types, all chains)?
Can an attacker exploit Solana's fast finality to act before the remote chain sees Solana state?
Are cross-chain prices validated for freshness AND deviation bounds?

Common False Positives

Monotonic state: If synced state only increases, arbitrage may not be profitable in both directions
Negligible delta: If max delta during sync window is <0.1%, may not be economically viable after bridge fees
Rate limiting: If operations have cooldowns longer than sync latency, window may not be exploitable
Confirmed finality enforcement: If protocol requires rooted/finalized Solana confirmations before processing, timing window is ~30s (larger but more reliable)
Bridge-level protections: Some bridges (Wormhole) have rate limiting or value caps that bound exploitation

Instantiation Parameters

{CONTRACTS}           - Programs to analyze
{BRIDGE_PROTOCOL}     - Specific bridge (Wormhole, Allbridge, deBridge, custom)
{SYNC_POINT}          - Instruction where cross-chain state is consumed
{DEPENDENT_FUNCTIONS} - Instructions that read synced state
{SOURCE_CHAIN}        - Chain where state originates
{MONITOR_POINT}       - What attacker monitors on source chain
{EXPLOIT_INSTRUCTION} - Instruction attacker calls on Solana
{STALE_STATE}         - Specific state that becomes stale
{LATENCY_ESTIMATE}    - Realistic bridge latency

Output Schema

Field	Required	Description
bridge_inventory	yes	All cross-chain messaging infrastructure
verification_audit	yes	VAA/message verification completeness
timing_windows	yes	Asymmetry windows with duration estimates
account_creation	yes	Recipient account requirements and failure modes
replay_protection	yes	Nonce/sequence management assessment
price_relay_audit	if applicable	Cross-chain price freshness and manipulation risk
arbitrage_viability	yes	Quantified attack profitability or NOT_VIABLE
finding	yes	CONFIRMED / REFUTED / CONTESTED
evidence	yes	Code locations with line numbers
step_execution	yes	Status for each step

Step Execution Checklist (MANDATORY)

Step	Required	Completed?	Notes
1. Identify Cross-Chain Messaging Infrastructure	YES
2. Cross-Chain Message Verification Audit	YES
3. Timing Window Analysis (both directions)	YES
4. Account Creation Requirements	YES
5. Nonce and Sequence Management	YES
6. Cross-Chain Price Relay Audit	IF price relay detected
7. Quantify Arbitrage Viability	YES

Cross-Reference Markers

After Step 2: If VAA verification is incomplete -> immediate finding, do not wait for timing analysis.

After Step 3: Feed timing windows to TEMPORAL_PARAMETER_STALENESS skill for parameters cached across chain boundaries.

After Step 4: If account creation can fail -> cross-reference with ACCOUNT_LIFECYCLE skill for stranded asset analysis (Rule 9).

After Step 6: Feed price staleness findings to ORACLE_ANALYSIS (Solana version) if applicable.

Files

Just SKILL.md in agents/skills/solana/cross-chain-timing of PlamenTSV/plamen.

Open the folder on GitHubat commit 795962b

Compare with similar skills

Cross Chain Timing next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Cross Chain Timing compared with similar skills
Skill	Stars	Used in	Tokens	Auto-check	Licence	Repo updated
Cross Chain Timing this skillPlamenTSV/plamen	303	—	~3.4k	Automated safety check: Pass	MIT	13 days ago
Solana Devsolana-foundation/solana-dev-skill	573	—	~3.8k	Automated safety check: Pass	MIT	yesterday
Meme Coin Security Auditawarexone/Agentic-Bug-Hunter	5.3k	1 repos	~2.4k	Automated safety check: Pass	MIT	today
Swapper Depositswapperfinance/swapper-toolkit	852	—	~1.8k	Automated safety check: Pass	MIT	6 mo ago
PNP Prediction Markets on Solanainternet-court/internet-court-skill	6.6k	—	~7.5k	Automated safety check: Notes	MIT	1 mo ago
Minara Crypto Trading and WalletMinara-AI/minara-skills	362	—	~5.7k	Automated safety check: Pass	None	23 days ago

Similar skills

Solana Dev
solana-foundation/solana-dev-skill
A skill your agent uses when user asks to "build a Solana dapp", "write an Anchor program", "create a token", "debug Solana errors", "set up wallet connection", "test my Solana program", "fuzz my…
573 GitHub stars~3.8k tokensUpdated yesterday
Backend & APIsAuto-check passed
Meme Coin Security Audit
awarexone/Agentic-Bug-Hunter
Screens EVM and Solana meme coins for rug pull signs such as hidden mint, honeypot logic and fee tricks, starting with fast kill signals before any code review.
5.3k GitHub starsUsed in 1 repo~2.4k tokens
SecurityAuto-check passed
Swapper Deposit
swapperfinance/swapper-toolkit
Deposit and bridge funds into a wallet or protocol using Swapper Finance.
852 GitHub stars~1.8k tokensUpdated 6 mo ago
Business, Finance & HRAuto-check passed
PNP Prediction Markets on Solana
internet-court/internet-court-skill
Creates, trades and settles permissionless prediction markets on Solana with any SPL token as collateral, including social-media and custom-oracle markets.
6.6k GitHub stars~7.5k tokensUpdated 1 mo ago
Business, Finance & HRAuto-check: notes
Minara Crypto Trading and Wallet
Minara-AI/minara-skills
Drives the Minara CLI for crypto swaps, perps, limit orders, wallet transfers, deposits and withdrawals, plus AI market analysis.
362 GitHub stars~5.7k tokensUpdated 23 days ago
Business, Finance & HRAuto-check passed
Manifest
Bonasa-Tech/manifest
A skill your agent uses when building, debugging, or integrating with the Manifest DEX on Solana, especially for TypeScript SDK usage, transaction construction with ManifestClient, market state…
158 GitHub stars~478 tokensUpdated today
DevelopmentAuto-check passed

Questions about Cross Chain Timing

What does Cross Chain Timing do?

When should I use Cross Chain Timing?

How do I install Cross Chain Timing in Claude Code?

Run `npx skills add PlamenTSV/plamen --skill cross-chain-timing -a claude-code`. Or copy the skill folder (agents/skills/solana/cross-chain-timing in PlamenTSV/plamen) into .claude/skills/cross-chain-timing in your project. Claude Code loads it when a task matches its description.

How do I install Cross Chain Timing in Codex?

Run `npx skills add PlamenTSV/plamen --skill cross-chain-timing -a codex`. Or copy the skill folder (agents/skills/solana/cross-chain-timing in PlamenTSV/plamen) into .agents/skills/cross-chain-timing in your project. Codex loads it when a task matches its description.

Can I use Cross Chain Timing in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add PlamenTSV/plamen --skill cross-chain-timing -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/cross-chain-timing, .gemini/skills/cross-chain-timing, .github/skills/cross-chain-timing and .opencode/skills/cross-chain-timing in your project.

What does Cross Chain Timing need to run?

SKILL.md names no scripts, command-line tools or credentials: Cross Chain Timing is instructions for the agent only.

Does Cross Chain Timing access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Cross Chain Timing safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Cross Chain Timing use?

Cross Chain Timing is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Cross Chain Timing use?

About 3.4k tokens (SKILL.md is roughly 14k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Cross Chain Timing?

Skills that share tags, products or a category with Cross Chain Timing: Solana Dev (solana-foundation/solana-dev-skill, 573 stars), Meme Coin Security Audit (awarexone/Agentic-Bug-Hunter, 5.3k stars), Swapper Deposit (swapperfinance/swapper-toolkit, 852 stars) and PNP Prediction Markets on Solana (internet-court/internet-court-skill, 6.6k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Cross Chain Timing?

PlamenTSV (a GitHub user) maintains it in PlamenTSV/plamen, which has 303 GitHub stars. The repository holds 87 skills in this directory. The repository was last updated on September 26, 2026.

Source: PlamenTSV/plamen on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.

Install Cross Chain Timing

Facts

At a glance

What it does

When your agent uses it

Example prompts

Workflow steps

What it can do on your machine

Tool permissions

Runs code

Network

Credentials

Context cost

Safety

SKILL.md

CROSS_CHAIN_TIMING Skill (Solana)

Step 1: Identify Cross-Chain Messaging Infrastructure

Wormhole-Specific Inventory

Allbridge/deBridge-Specific Inventory

Step 2: Cross-Chain Message Verification Audit

2a. Wormhole VAA Verification Checklist

2b. Generic Bridge Verification

Step 3: Timing Window Analysis

3a. Finality Asymmetry Model

3b. Stale State Usage Trace

3c. Solana-to-Remote Timing Attack

3d. Remote-to-Solana Timing Attack

Step 4: Account Creation Requirements

Step 5: Nonce and Sequence Management

Step 6: Cross-Chain Price Relay Audit

Step 7: Quantify Arbitrage Viability

Key Questions (must answer all)

Common False Positives

Instantiation Parameters

Output Schema

Step Execution Checklist (MANDATORY)

Cross-Reference Markers

Files

Compare with similar skills

Similar skills

More from PlamenTSV/plamen

Related

Questions about Cross Chain Timing