pharos-approvals — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pharos-approvals (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The ERC20 approval lifecycle for Pharos agents: approve, read allowance, revoke (reset to zero), and transferFrom — each guarded by a preflight dry-run before broadcasting. This is the primitive the official pharos-skill-engine does not ship, yet every DeFi interaction (swap / stake / deposit) needs it first.
which cast. If not found, install: curl -L https://foundry.paradigm.xyz | bash
source ~/.zshenv && foundryup
cast --versionIf installation fails, inform the user and STOP. Do not fall back to raw JSON-RPC.
approve, revoke, transferFrom), via--private-key $PRIVATE_KEY. Reads (allowance) need no key.
Network info lives in assets/networks.json (Atlantic testnet + mainnet), identical in shape to the official engine.
atlantic-testnet (used when the user does not specify a network).mainnet, read that entry's rpcUrl.rpcUrl into each command's --rpc-url: RPC_URL=$(jq -r '.networks[] | select(.name=="atlantic-testnet") | .rpcUrl' assets/networks.json)| User Need | Capability | Detailed Instructions |
|---|---|---|
| Approve a spender to spend my token | cast send approve(address,uint256) | → references/approve.md#approve-grant-an-allowance |
| Check how much a spender is allowed | cast call allowance(address,address) | → references/approve.md#allowance-read-an-approval |
| Revoke / reset an approval to zero | cast send approve(spender,0) | → references/approve.md#revoke-reset-an-allowance-to-zero |
| Move tokens via an existing allowance | cast send transferFrom(address,address,uint256) | → references/approve.md#transferfrom-spend-an-allowance |
| Dry-run / simulate any write before sending | cast call + revert decode | → references/preflight.md |
type(uint256).max) are aprimary wallet-drainer vector. Default to the exact amount the user needs; only use unlimited when the user explicitly asks, and warn them when you do.
--private-key $PRIVATE_KEY (cast does NOT auto-read env vars).
mainnet.
Before any approve / revoke / transferFrom:
[ -n "$PRIVATE_KEY" ] && echo "PRIVATE_KEY is set" || echo "PRIVATE_KEY is not set"If not set, tell the user to export PRIVATE_KEY=<key> and stop.
cast wallet address --private-key $PRIVATE_KEYassets/networks.json). Formainnet, warn and require explicit re-confirmation.
references/preflight.md) — simulate with cast calland decode any revert BEFORE broadcasting.
| Error Signature | Handling |
|---|---|
invalid address | Check address format (0x + 40 hex chars) |
execution reverted | Decode and display the revert reason (see references/preflight.md) |
missing --private-key | Prompt the user to pass --private-key $PRIVATE_KEY |
insufficient funds | Insufficient gas balance; show current balance |
nonce too low | Suggest waiting or specifying a nonce |
assets/networks.json unreadable | Config missing/invalid |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.