pharos-defi-play — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pharos-defi-play (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Composed, multi-step on-chain plays for Pharos agents. A "play" is a guarded sequence of primitives — the canonical one being approve → call, the building block of every swap / stake / deposit. This skill sequences those steps safely (preflight each, abort on revert) and ships one worked vault deposit/withdraw play with a self-contained MockVault demo target.
Builds on:
pharos-skill-engine (deploy, write, query), andwhich cast; install per thepharos-approvals SKILL.md if missing).
--private-key $PRIVATE_KEY for the write steps.approve andpreflight references rather than redefining them.
Same as the rest of the suite: read assets/networks.json, default atlantic-testnet, fill rpcUrl into --rpc-url. Mainnet requires an explicit warning.
RPC_URL=$(jq -r '.networks[] | select(.name=="atlantic-testnet") | .rpcUrl' assets/networks.json)| User Need | Capability | Detailed Instructions |
|---|---|---|
| Approve then call any contract method (deposit/stake/...) | guarded approve-then-call sequence | → references/play.md#approve-then-call-generic |
| Deposit a token into a vault and confirm shares | worked vault play | → references/play.md#vault-deposit-worked-play |
| Withdraw a token from the vault | worked vault play | → references/play.md#vault-withdraw |
| Deploy the demo MockVault target | forge create / forge script | → references/play.md#deploy-the-mockvault-demo-target |
just because a play follows the approval — scope the allowance to the deposit/stake amount.
step N. If any preflight reverts, STOP and report — do not leave the user approved but un-deposited.
Identical to pharos-approvals (SKILL.md): private-key check → derive + confirm sender → confirm network → preflight. Run them once before starting a play; re-derive the sender address only, not re-confirm, between steps of the same play.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.