pharos-allowance-guard — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pharos-allowance-guard (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The security auditor for ERC20 approvals on Pharos. Unlimited and stale approvals are the #1 wallet-drainer vector — this skill lets an agent find every spender a user has approved for a token, flag the risky ones, and batch-revoke them. The natural companion to pharos-approvals (which grants allowances safely; this one audits and cleans them up).
which cast; install per pharos-approvals if missing).--private-key $PRIVATE_KEY). The audititself is read-only and needs no key.
Read assets/networks.json, default atlantic-testnet, fill rpcUrl into --rpc-url.
RPC_URL=$(jq -r '.networks[] | select(.name=="atlantic-testnet") | .rpcUrl' assets/networks.json)| User Need | Capability | Detailed Instructions |
|---|---|---|
| List every spender I've approved for a token | scan Approval event logs + resolve live allowance | → references/audit.md#audit-list-spenders |
| Flag unlimited / risky approvals | classify live allowance values | → references/audit.md#flag-classify-risk |
| Revoke several approvals at once | batch approve(spender, 0) | → references/audit.md#batch-revoke |
resolve the current allowance for each discovered spender; an event may have been superseded by a later revoke.
allowance == type(uint256).max as unlimited (⚠️ high risk) andrecommend revoking unless the user actively uses that spender.
pharos-approvalsSKILL.md), confirm the network, and never log keys.
Same protocol as the rest of the suite: private-key check → derive + confirm sender → confirm network (warn on mainnet) → preflight each approve(spender, 0) before broadcasting.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.