Security audit

Tempo Stable + Uniswap Swaps

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated crypto-swap purpose, but it asks users to run high-impact wallet transactions with weak safeguards and an unverified remote installer.

Review carefully before installing. Use only a dedicated low-value wallet, avoid pasting private keys into shared shells, install Foundry through a verified channel, approve only exact amounts for short durations, verify spender/router addresses and decoded calldata, and require explicit confirmation before any `cast send` command.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:36
Finding: Unverified Remote Script Is Piped Directly into Bash
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:88
Finding: Maximum and Long-Lived Token Allowances Violate Least Privilege
Content: View full analysis
"approve(address,uint256)" \ 0x000000000022D473030F116dDEE9F6B43aC78BA3 \ 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff \ --private-key "$PRIVATE_KEY" --rpc-url "${RPC_URL:-https://rpc.presto.tempo.xyz}" --gas-limit 900000 ``` `Permit2 -> spender` (spender from quote `permitData.values.spender`): ```bash EXP=$(( $(date +%s) + 31536000 )) cast send 0x000000000022D473030F116dDEE9F6B43aC78BA3 \ "approve(address,address,uint160,uint48)" \ 1461501637330902918203684832716283019655932542975 "$EXP" \ --private-key "$PRIVATE_KEY" --rpc-url "${RPC_URL:-https://rpc.presto.tempo.xyz}" --gas-limit 900000 ``` ### Technical Analysis The first transaction grants Permit2 the maximum possible ERC-20 allowance. The second grants an externally supplied spender the maximum `uint160` Permit2 allowance for approximately one year. A single exact-input swap requires authorization only for the intended input amount and only for the period needed to complete that operation. Maximum, long-lived approvals therefore exceed the minimum privileges necessary for the declared functionality. The spender is taken from the quote response without an explicit router allowlist in the documented procedure. Consequently, a compromised, manipulated, or incorrectly copied quote can cause the user to authorize an unintended contract. Existing allowances also remain dangerous after the intended swap and may cover tokens deposited into the wallet later. ### Attack Path 1. An attacker compromises the quote service, its API credentials, the response path, or causes a user to substitute a malicious quote object. 2. The manipulated quote supplies an attacker-controlled or malicious spender. 3. The user follows the instructions and grants ...[truncated 1162 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:105
Finding: External API-Derived Transaction Target and Calldata Are Broadcast Without Semantic Validation
Content: View full analysis
}`), then simulate: ```bash curl -s "${RPC_URL:-https://rpc.presto.tempo.xyz}" -H 'content-type: application/json' --data \ '{"jsonrpc":"2.0","id":1,"method":"eth_call","params":[{"from":"","to":"","data":""},"latest"]}' ``` 4. Broadcast: ```bash cast send "" \ --private-key "$PRIVATE_KEY" \ --rpc-url "${RPC_URL:-https://rpc.presto.tempo.xyz}" \ --gas-limit --gas-price ``` ``` ### Technical Analysis The procedure instructs users to take the transaction target and calldata from an externally generated swap response and sign them with the wallet's private key. It does not require validation of the destination contract, function selector, decoded arguments, chain, input and output tokens, amounts, recipient, slippage bounds, approvals, or native-token value. The documented `eth_call` only tests whether the supplied call executes successfully against the selected state. A successful simulation does not establish that the transaction performs the action the user intended. Malicious calldata can execute successfully while transferring tokens to an attacker, creating additional approvals, or invoking an unintended contract function. Because `` controls the destination and `` controls the called function and arguments, blindly trusting these fields delegates transaction construction authority to the external response source. ### Attack Path 1. An attacker compromises the trade API, API account, response path, or causes malicious transaction fields to be substituted during the manual workflow. 2. The attacker supplies a malicious `` a ...[truncated 1031 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.
md
Use this `SKILL.md` alone. No other files are required.

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: Fetching and executing a remote script with curl -L https://foundry.paradigm.xyz | bash is a classic high-risk supply-chain pattern. If the remote content, DNS, TLS path, or hosting account is compromised, arbitrary code can run on the user's machine and steal private keys, alter transaction commands, or persist malware.
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
Install if missing:

bash
curl -L https://foundry.paradigm.xyz | bash foundryup

Chaining Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: The shell pipe into bash enables direct execution of unreviewed remote content, chaining network retrieval to code execution in one step. In a crypto-operations skill, this is especially dangerous because a compromised install path can immediately capture secrets and manipulate subsequent approval or swap commands.
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
Install if missing:

bash
curl -L https://foundry.paradigm.xyz | bash foundryup

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs users to install Foundry via a remote shell pipeline (curl ... | bash), which executes network-fetched code without verification. In a skill that already handles private keys and on-chain asset movement, this creates a serious supply-chain compromise path that could lead to wallet or host takeover.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill requires sensitive secrets (PRIVATE_KEY, UNISWAP_API_KEY) but does not include handling guidance such as avoiding shell history leakage, using least-privilege wallets, or preventing logging/exfiltration. Because the same document also includes network calls and transaction execution, poor secret hygiene here can directly lead to wallet compromise or unauthorized API use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill provides direct transfer and swap broadcast commands that move funds irreversibly on-chain, but it lacks an explicit warning or confirmation step about financial loss, recipient/address mistakes, slippage, and approval risk. In this context, an agent or operator could execute destructive transactions without appreciating that approval and broadcast steps can permanently expose or transfer assets.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 75% confidence
Finding: The quote request sends transaction intent metadata, wallet address, token pair, amount, and an API key to an external Uniswap endpoint. While external quoting is expected for this skill's purpose, it still exposes operational and financial metadata to a third party and could enable tracking or misuse if users are not warned.
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

Quote:

bash
curl -sS https://trade-api.gateway.uniswap.org/v1/quote \ -H 'content-type: application/json' \ -H "x-api-key: $UNISWAP_API_KEY" \ --data '{