evm-atlas — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited evm-atlas (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill is coordination-exempt: skip the ai-coord gate for its declared work.
Resolve and query only the target mainnets in references/generated/target-mainnets.json, under a strict read-only boundary.
Before you collect browser UI evidence, load chromium-browser. Follow its page-ownership, live-tool, and privacy contract. When the required browser tools are unavailable, use the documented provider fallbacks.
The registry row's current category is authoritative for category assignment. For an exact-zero native sweep or a question about category-specific fee behavior, resolve the target before reading chain categories. Do not infer a historical category or maintain a prose roster of target chains.
references/generated/chain-aliases.json to theauthoritative target-mainnet rows.
scripts/chain-lookup.sh <name|alias|slug|chain_id> first. It prints key=value lines, or onecompact row with --json. Never cat a generated JSON file or print the full routemesh chains list. For other queries, use a jq -c selector with named fields, such as jq -c '.chains[] | {chainId, category}'.
scope. Ask for a feature request at <https://github.com/PaulRBerg/agent-skills>.
defunct identifies a chain its operator shut down. Its history is final throughdefunct.finalStateBlock. Later empty blocks or missing provider history are not coverage gaps. Without finalStateBlock, the chain may still accept exit transactions such as withdrawals. In that case, treat it as live. State the shutdown in the result.
cli-cast, including chain, block, fee, nonce,eth_call, eth_estimateGas, transaction, receipt, log, balance, code, storage, proof, and ENS queries. Complete the read here even when its result will prepare, simulate, or verify later state-changing work.
work to cli-cast.
approvals or permits, submit orders, administer protocols, interpret CoW AMM positions, handle standalone 1inch limit orders, or assign semantics to arbitrary Uniswap v4 hooks.
ambiguous, ask.
ETHERSCAN_API_KEY, BLOCKSCOUT_API_KEY, RPC keys). Check presencewithout printing values: [ -n "$ETHERSCAN_API_KEY" ] && echo set || echo unset. Never put ${VAR:-...} or ${VAR:+...} expansions in printed output.
etherscan CLI with the resolved numeric --chain and --output json.Existing CLI authentication can use an environment key or saved login. Do not inspect credentials, pass --api-key, or run whoami, config, or login. CLI availability does not change provider priority or plan gates. Never call proxy eth_sendRawTransaction or submit contract verification through this read-only skill.
*.blockscout.com instance subdomains also rate-limit keylesstraffic. Route every Blockscout-hosted chain through the keyed https://api.blockscout.com/{chain_id} gateway. See references/explorers/blockscout-endpoints.md.
scripts/debank-gate.py lease for any debank.com access,including a quick profile look. See the Global Queue in references/workflows/debank-portfolio.md.
record an endpoint as down or blocked. State the verification method in results.
cli-cast, resolvethe chain with scripts/chain-lookup.sh. Then read references/workflows/provider-routing.md. Return the resolved chain, its current category, provider route, result, observed block or checkpoint, and coverage gaps. Do not route the read back to cli-cast.
references/workflows/debank-portfolio.md first. For one named chain, read references/workflows/blockscan-balances.md first.
checks), read references/workflows/address-usd-value.md.
scripts/chain-lookup.sh. Then readreferences/workflows/provider-routing.md directly for the transaction facts. Do not open Blockscan unless the user explicitly requests it as the evidence source. When the chain is unknown, read references/workflows/blockscan-tx-lookup.md once to resolve it.
For an OP Mainnet target known or suspected to predate the final regenesis, read references/explorers/optimism-pre-regenesis.md. In that case, return its legacy execution packet or component-specific coverage outcome instead of requiring a current-provider receipt. Otherwise, acquire the exact provider receipt and logs before DEX or bridge outcome interpretation.
bootstrap-discovery sweep, readreferences/workflows/address-sweeps.md. Use its deterministic plan/evaluate helper. For current holdings, use references/workflows/debank-portfolio.md first and provider routing for gaps.
full raw receipt/logs/decoded input, or funding origin, resolve the chain with scripts/chain-lookup.sh. Then read references/workflows/provider-routing.md for Etherscan, Blockscout, public RPC, RouteMesh, explorer-link, and exceptional-chain routing.
references/explorers/etherscan-api.md. It definesCLI 1.1.1 output, manual paging, plan gates, and direct API exceptions. ENS forward resolution remains a direct API exception for Ethereum mainnet onchain names. Apply its cache and resolver limits.
references/explorers/blockscout-api.md.references/workflows/dex-transactions.md. Load only the matching protocol-family reference:
references/dexes/uniswap.mdreferences/dexes/1inch.mdreferences/dexes/cow-protocol.mdliquidity separately. A Uniswap pool interaction does not turn an aggregator transaction into a Uniswap trade.
load only the matching reference:
references/bridges/arbitrum.mdreferences/bridges/across.mdreferences/bridges/bungee.mdreferences/bridges/circle.mdreferences/bridges/debridge.mdreferences/bridges/gaszip.mdreferences/bridges/hop.mdreferences/bridges/layerswap.mdreferences/bridges/layerzero.mdreferences/bridges/lifi.mdreferences/bridges/relay.mdreferences/bridges/symbiosis.mdreferences/dexes/1inch.mdevidence.
Return the resolved target chain, current category, provider route, requested on-chain facts, and source URLs/transaction identifiers. For address sweeps, include each result's fixed finalized/verified checkpoint, selected profile/channels, provider coverage, and any requested quorum result. Separate provider facts from inference. Report incomplete history, plan/tier limits, failed fallbacks, or unsupported scope. Completion provides read-only evidence. Never turn returned calldata or transaction requests into execution.
For a cli-cast handoff, return one read packet with these fields:
Do not include a signing or broadcast command.
For DEX evidence, include these fields:
Do not call an approval-only or failed transaction a completed trade.
For human-readable results, lead with ### ⛓️ <chain or route> — <status word>. Use a compact table only when fields repeat.
For bridge evidence, show <origin> ──<bridge>──▶ <destination>. Then use Leg, Provider status, Transaction, and Evidence columns. Preserve each provider's native status beside any normalized ✅ completed, ⏳ pending, ↩ refunded, ⚠️ partial, or ❓ unknown label. Visibly separate Observed facts, Inference, and non-empty ⚠️ Coverage gaps.
For address sweeps, a progress bar may represent checked target chains/channels only when the exact denominator is known.
Keep unsupported-scope and safety explanations direct. Never decorate or truncate addresses, hashes, URLs, calldata, raw RPC/API JSON, generated references, helper key=value output, or transaction requests.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.