React Audit Grep Patterns
github/awesome-copilot
Provides the complete, verified grep scan command library for auditing React codebases before a React 18.3.1 or React 19 upgrade.
Trigger Pattern Always required for DAML audits (self-skips if no lock pattern present) - Inject Into Breadth agents, depth-state-trace, depth-edge-case
MITAuto-check passed
Install Locking Semantics
$ npx skills add PlamenTSV/plamen --skill locking-semantics -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install PlamenTSV/plamen locking-semantics --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .claude/skills && cp -r skills-src/agents/skills/daml/locking-semantics .claude/skills/locking-semantics && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "locking-semantics" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/daml/locking-semantics into .claude/skills/locking-semantics/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "locking-semantics", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/PlamenTSV/plamen/tree/main/agents/skills/daml/locking-semanticsType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add PlamenTSV/plamen --skill locking-semantics -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install PlamenTSV/plamen locking-semantics --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .agents/skills && cp -r skills-src/agents/skills/daml/locking-semantics .agents/skills/locking-semantics && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "locking-semantics" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/daml/locking-semantics into .agents/skills/locking-semantics/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "locking-semantics", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add PlamenTSV/plamen --skill locking-semantics -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install PlamenTSV/plamen locking-semantics --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/agents/skills/daml/locking-semantics .cursor/skills/locking-semantics && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "locking-semantics" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/daml/locking-semantics into .cursor/skills/locking-semantics/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "locking-semantics", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/PlamenTSV/plamen.git --path agents/skills/daml/locking-semantics--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add PlamenTSV/plamen --skill locking-semantics -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install PlamenTSV/plamen locking-semantics --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/agents/skills/daml/locking-semantics .gemini/skills/locking-semantics && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "locking-semantics" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/daml/locking-semantics into .gemini/skills/locking-semantics/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "locking-semantics", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install PlamenTSV/plamen locking-semanticsInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add PlamenTSV/plamen --skill locking-semantics -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .github/skills && cp -r skills-src/agents/skills/daml/locking-semantics .github/skills/locking-semantics && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "locking-semantics" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/daml/locking-semantics into .github/skills/locking-semantics/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "locking-semantics", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add PlamenTSV/plamen --skill locking-semantics -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install PlamenTSV/plamen locking-semantics --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/PlamenTSV/plamen.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/agents/skills/daml/locking-semantics .opencode/skills/locking-semantics && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "locking-semantics" agent skill from https://github.com/PlamenTSV/plamen/tree/main/agents/skills/daml/locking-semantics into .opencode/skills/locking-semantics/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "locking-semantics", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
locking-semantics- GitHub stars
- 303
- Token cost
- ~1.4k tokens
- SKILL.md length
- 560 words
- Files
- 1
- Skills in repo
- 87
- Repo updated
- First seen
- Licence
- MIT
At a glance
Trigger Pattern Always required for DAML audits (self-skips if no lock pattern present) - Inject Into Breadth agents, depth-state-trace, depth-edge-case
- Works in 4 steps: Lock-State Inventory → Lock-Honoring Audit (lock-bypass) → Lock-Erase Audit → …
- Pattern Always required for DAML audits (self-skips if no lock pattern present) - Inject Into Breadth agents
- SKILL.md covers 1. Lock-State Inventory, 2. Lock-Honoring Audit…, 3. Lock-Erase Audit and 4. Value-Conservation Across…, plus 2 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Locking Semantics is an agent skill from PlamenTSV/plamen. Trigger Pattern Always required for DAML audits (self-skips if no lock pattern present) - Inject Into Breadth agents, depth-state-trace, depth-edge-case
Its SKILL.md is about 1.4k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
The repository describes itself as: Autonomous Web3 security audit agent for Claude Code. The licence is MIT.
When your agent uses it
- Pattern Always required for DAML audits (self-skips if no lock pattern present) - Inject Into Breadth agents
- Depth-state-trace
- Depth-edge-case
Example prompts
- “/locking-semantics”
Workflow steps
4 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 795962b. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are markdown).
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Locking Semantics loads about 1.4k tokens when it runs. Until then it costs about 43 tokens; SKILL.md has 560 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from PlamenTSV/plamen at commit 795962b, republished under its MIT licence (© PlamenTSV). 560 words, ~1,443 tokens.
Download SKILL.mdSave it as
.claude/skills/locking-semantics/SKILL.md (or your agent's skills folder).- name
- locking-semantics
- description
- Trigger Pattern Always required for DAML audits (self-skips if no lock pattern present) - Inject Into Breadth agents, depth-state-trace, depth-edge-case
LOCKING_SEMANTICS Skill (DAML)
Trigger Pattern: Always required for DAML audits — self-skip if no lock pattern present Inject Into: Breadth agents, depth-state-trace, depth-edge-case Finding prefix:
[DML-LK-N]Rules referenced: R8, R10, R14
DAML has no native lock primitive; locking is emulated by a template field (locked : Bool, lockedUntil : Time, a held lock contract, or a separate Locked template wrapping the asset). The invariant is: while locked, the asset MUST NOT be split, merged, transferred, or archived through any path; and the value MUST be conserved across the lock→unlock cycle. The two high-yield bugs are lock-bypass (a choice that moves the asset ignores the lock field) and lock-erase (a choice recreates the asset successor dropping the locked field). If no template carries a lock field / lock wrapper, this skill self-skips.
1. Lock-State Inventory
Identify every lock mechanism and the asset it protects:
| Template | Lock Mechanism | Lock Field/Wrapper | Set By (choice) | Cleared By (choice) | Asset Protected |
|---|---|---|---|---|---|
{T} | bool field / time field / Locked wrapper | {locked / lockedUntil} | {choice} | {choice} | {asset field} |
DAML note: A lock encoded as a plain Bool/Time field on the asset template is only honored if EVERY value-moving choice reads it. A lock encoded as a separate wrapper template is only honored if the underlying asset cannot be exercised directly while wrapped.
2. Lock-Honoring Audit (lock-bypass)
For EVERY value-moving choice on a lockable template, verify it checks the lock:
| Template.Choice | Moves/Splits/Merges/Archives Asset? | Reads Lock Field? | Lock Check Expr | Bypassable? |
|---|---|---|---|---|
{T.C} | YES/NO | YES/NO | assertMsg "locked" (not locked) / NONE | [DML-LK-N] if moves while locked |
Attack: A Transfer/Split choice does not read locked, so a locked asset can still be moved ([ELEVATE:LOCK_BYPASS]). For wrapper-based locks: verify the underlying asset's own choices are not directly exercisable while wrapped (e.g., the wrapper holds the only ContractId and the asset's signatories prevent independent exercise).
Check for:
- ANY value-moving choice with zero lock check on a lockable template.
- A time-lock (
lockedUntil) compared with the wrong relation (>=vs>) or against a caller-supplied time instead ofgetTime.
Show full SKILL.md (235 more words)Show less
3. Lock-Erase Audit
A choice that recreates the asset successor must carry the lock field forward.
| Template.Choice | Recreates Asset Successor? | Carries locked Forward? | Erase Risk? |
|---|---|---|---|
{T.C} | YES/NO | YES/NO | [DML-LK-N] if successor unlocked |
Attack: A consuming choice (e.g., a metadata update or partial action) archives the locked asset and creates a successor with locked = False (or omits the field, defaulting unlocked). The lock is silently erased and the asset is now freely movable. Verify every successor of a locked contract preserves the lock state.
4. Value-Conservation Across Lock/Unlock
The lock→unlock cycle must conserve the protected value and not double-count it.
| Lock Choice | Unlock Choice | Value Locked | Value Returned On Unlock | Conserved? | Finding? |
|---|---|---|---|---|---|
{choice} | {choice} | {amount} | {amount} | YES/NO | [DML-LK-N] if mismatch |
Check for (R14):
- Unlock returns MORE than was locked (value inflation) or LESS (value loss).
- The locked asset is counted both in a
Lockedwrapper AND still in the original holder's balance (double-count). - A unlock path reachable without the corresponding lock (mint-on-unlock), or a lock with no unlock (permanent loss / brick).
Finding Template
**ID**: [DML-LK-N]
**Severity**: [Critical if locked value moved/inflated, High if lock erased, Medium if liveness/double-count]
**Step Execution**: ✓1,2,3,4 | ✗(reasons) | ?(uncertain)
**Rules Applied**: [R8:✓/✗, R10:✓/✗, R14:✓/✗]
**Location**: {Module}.daml:LineN (template X, choice Y)
**Title**: {Choice} ignores lock / erases lock on successor allows moving locked {asset}
**Description**: [The lock mechanism, the choice that bypasses or erases it, and the value path that breaks the invariant]
**Impact**: [Locked asset moved despite lock / lock silently cleared / value inflated or double-counted across lock cycle]
**PoC steer**: lock the asset, then `submit owner (exerciseCmd cid Transfer ...)` and assert it SUCCEEDS (bypass); or update-then-`query@T` the successor and assert `locked == False` (erase); or assert unlock value /= locked value (conservation).Step Execution Checklist (MANDATORY)
| Section | Required | Completed? | Notes |
|---|---|---|---|
| 1. Lock-State Inventory | IF lock pattern present | ✓/✗(N/A)/? | Every lock field/wrapper and protected asset |
| 2. Lock-Honoring Audit | IF lockable template present | ✓/✗(N/A)/? | Every value-moving choice reads the lock |
| 3. Lock-Erase Audit | IF lockable template present | ✓/✗(N/A)/? | Every successor carries lock forward |
| 4. Value-Conservation Across Lock/Unlock | IF lock+unlock cycle present | ✓/✗(N/A)/? | Lock/unlock value parity, no double-count |
© PlamenTSV, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in agents/skills/daml/locking-semantics of PlamenTSV/plamen.
Open the folder on GitHubat commit 795962b
Compare with similar skills
Locking Semantics next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Locking Semantics this skillPlamenTSV/plamen | 303 | — | ~1.4k | Automated safety check: Pass | MIT | |
| React Audit Grep Patternsgithub/awesome-copilot | 40k | 1 repos | ~461 | Automated safety check: Pass | MIT | |
| Golang Patternsaffaan-m/ECC | 275k | — | ~1.1k | Automated safety check: Pass | MIT | |
| Kotlin Exposed Patternsaffaan-m/ECC | 275k | 4 repos | ~5.5k | Automated safety check: Pass | MIT | |
| Dotnet Patternsaffaan-m/ECC | 275k | 1 repos | ~2.3k | Automated safety check: Pass | MIT | |
| Fastapi Patternsaffaan-m/ECC | 275k | — | ~2.3k | Automated safety check: Pass | MIT |
Similar skills
- Official
Golang Patterns
affaan-m/ECC
Go-specific design patterns and best practices including functional options, small interfaces, dependency injection, concurrency patterns, error handling, and package organization.
Kotlin Exposed Patterns
affaan-m/ECC
JetBrains Exposed ORM patterns including DSL queries, DAO pattern, transactions, HikariCP connection pooling, Flyway migrations, and repository pattern.
Dotnet Patterns
affaan-m/ECC
Idiomatic C and .NET patterns, conventions, dependency injection, async/await, and best practices for building robust, maintainable .NET applications.
Fastapi Patterns
affaan-m/ECC
FastAPI patterns for async APIs, dependency injection, Pydantic request and response models, OpenAPI docs, tests, security, and production readiness.
Python Patterns
affaan-m/ECC
Python-specific design patterns and best practices including protocols, dataclasses, context managers, decorators, async/await, type hints, and package organization.
More from PlamenTSV/plamen
All 87 skills in this repoAudit Prep
PlamenTSV/plamen
Prepare Solidity projects for a security audit — test coverage, test quality, NatSpec docs, code hygiene, dependency health, best-practice enforcement, deployment readiness, and project…
Verification Protocol
PlamenTSV/plamen
Trigger Pattern Always (used by all verifier agents) - Inject Into security-verifier agents (Phase 5)
Ability Analysis
PlamenTSV/plamen
Trigger Pattern Always (Aptos Move) - foundational security check - Inject Into Breadth agents, depth agents
Ability Analysis
PlamenTSV/plamen
Trigger Pattern Always (Sui Move) -- foundational security check - Inject Into Breadth agents, depth agents
Account Lifecycle
PlamenTSV/plamen
Trigger Pattern ACCOUNTCLOSING flag detected (close/CloseAccount usage) - Inject Into Breadth agents, depth agents
Account Validation
PlamenTSV/plamen
Trigger Pattern Always required for Solana audits - Inject Into Breadth agents, depth agents
Questions about Locking Semantics
What does Locking Semantics do?
Trigger Pattern Always required for DAML audits (self-skips if no lock pattern present) - Inject Into Breadth agents, depth-state-trace, depth-edge-case. Locking Semantics is an agent skill from PlamenTSV/plamen.
When should I use Locking Semantics?
Locking Semantics fits situations like: pattern Always required for DAML audits (self-skips if no lock pattern present) - Inject Into Breadth agents; depth-state-trace; depth-edge-case.
How do I install Locking Semantics in Claude Code?
Run `npx skills add PlamenTSV/plamen --skill locking-semantics -a claude-code`. Or copy the skill folder (agents/skills/daml/locking-semantics in PlamenTSV/plamen) into .claude/skills/locking-semantics in your project. Claude Code loads it when a task matches its description.
How do I install Locking Semantics in Codex?
Run `npx skills add PlamenTSV/plamen --skill locking-semantics -a codex`. Or copy the skill folder (agents/skills/daml/locking-semantics in PlamenTSV/plamen) into .agents/skills/locking-semantics in your project. Codex loads it when a task matches its description.
Can I use Locking Semantics in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add PlamenTSV/plamen --skill locking-semantics -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/locking-semantics, .gemini/skills/locking-semantics, .github/skills/locking-semantics and .opencode/skills/locking-semantics in your project.
What does Locking Semantics need to run?
SKILL.md names no scripts, command-line tools or credentials: Locking Semantics is instructions for the agent only.
Does Locking Semantics access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Locking Semantics safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Locking Semantics use?
Locking Semantics is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Locking Semantics use?
About 1.4k tokens (SKILL.md is roughly 5.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Locking Semantics?
Skills that share tags, products or a category with Locking Semantics: React Audit Grep Patterns (github/awesome-copilot, 40k stars), Golang Patterns (affaan-m/ECC, 275k stars), Kotlin Exposed Patterns (affaan-m/ECC, 275k stars) and Dotnet Patterns (affaan-m/ECC, 275k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Locking Semantics?
PlamenTSV (a GitHub user) maintains it in PlamenTSV/plamen, which has 303 GitHub stars. The repository holds 87 skills in this directory. The repository was last updated on September 26, 2026.
Source: PlamenTSV/plamen on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.