ClawHub
Back to skill

Security audit

ghostbot-uniswap-v4

Security checks for vulnerabilities and agentic risk

Overview

This Sepolia DeFi skill is not malicious, but it can sign blockchain transactions and handle private keys with weaker safeguards than users are likely to expect.

Install only if you intend to interact with this specific Sepolia deployment. Use a dedicated low-value Sepolia key that is not reused elsewhere, review transaction details before running write commands, and be aware that the scripts currently require a private key even for read-only queries. Treat the approvals and zero-slippage liquidity defaults as review items before using the pattern outside testnet.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/add-liquidity.mjs:46
Finding

Liquidity Transactions Use Zero Slippage Protection and Excessive Token Allowances

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/config.mjs:21
Finding

Read-Only Commands Unnecessarily Require and Materialize a Private Key

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/package.json:5
Finding

Unlocked Dependency Resolution Makes Installations Non-Reproducible

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/post-signal.mjs:12
Finding

State-Changing Commands Forward Unvalidated User-Controlled Parameters

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill advertises itself for broad topics like DeFi liquidity provision, impermanent loss, and automated market making, which can cause it to activate for general informational conversations beyond its safe transactional scope. That over-broad invocation surface is dangerous because users may be funneled into scripts that interact with wallets or contracts when they only asked for education or analysis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The command section describes liquidity-management operations and wallet-backed scripts without a clear, prominent warning that these actions may use a built-in demo wallet, approve tokens, mint tokens, and submit blockchain transactions. Even on testnet, this can normalize unsafe behavior and cause users or agents to execute state-changing commands without informed consent or understanding of key material and transaction side effects.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The architecture section includes unrelated shell commands embedded in the documented execution flow, which can mislead an agent or operator into running unintended local commands. In a skill that is supposed to bridge chat actions to blockchain transactions, contradictory command text increases the risk of prompt/command confusion and accidental execution of actions outside the intended workflow.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency uses a caret range (^2.20.0), which permits automatic installation of newer minor and patch releases rather than a single immutable version. In a security-sensitive DeFi automation skill, this increases supply-chain risk because a compromised upstream release or unexpected behavioral change in the viem library could alter transaction-building, signing, or on-chain interaction logic without an explicit review.

Content

Scanner excerpt · scripts/package.json (reported line 6)May include surrounding context.

json
"type": "module",
  "private": true,
  "dependencies": {
    "viem": "^2.20.0"
  }
}

Static analysis

No suspicious patterns detected.