| name | paxeer-audit |
| description | Read-only smart-contract security review on Paxeer. Pulls verified source (or bytecode), enumerates the privileged surface, flags risky patterns, and returns a severity-rated report (LOW/MEDIUM/HIGH/CRITICAL) with evidence. No transaction is ever signed. |
| origin | Matrix/Paxeer |
Paxeer Audit
Read-only smart-contract security review — the audit-firm moat as a skill. A
user hands over a contract address and gets a severity-rated report grounded in
real source/bytecode. This skill signs nothing and moves no value.
What it inspects (all read-only)
- Source + verification —
paxscan_get (Blockscout v2 smart-contract route)
for verified source/ABI; address_overview for verification status + age. An
unverified contract is flagged and never assumed safe.
- Privileged surface —
contract_read / eth_call: ownership, EIP-1967
upgradeability/proxy admin, mint authority, pause, blacklist/allowlist,
fee/tax setters, withdraw/sweep/rescue, delegatecall/selfdestruct.
- Recent privileged activity —
address_transactions.
The report
An overall rating — LOW / MEDIUM / HIGH / CRITICAL — and an itemised
findings list, each with a severity and the concrete evidence (function
name/selector, source excerpt, or read result).
Anti-fake mandate (the planner MUST follow)
- A finding REQUIRES grounding in retrieved source, bytecode, or a read result;
NEVER report a vulnerability from memory or assumption.
- Confirmed findings are separated from areas not inspected (marked unknown).
- An unverified contract is flagged as such, never assumed safe.
- This skill has NO write tools: no transaction, ever.
Reporting
Plain bottom line: safe to interact with / approve, and under what caution.
Persist each finding as a Fact. Automated review — not a substitute for a full
manual audit.
