Tempo Stable + Uniswap Swaps

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:10 AM UTC
• Version: 1.0.0

Overview

The skill matches its stated crypto-swap purpose, but it asks users to run high-impact wallet transactions with weak safeguards and an unverified remote installer.

Review carefully before installing. Use only a dedicated low-value wallet, avoid pasting private keys into shared shells, install Foundry through a verified channel, approve only exact amounts for short durations, verify spender/router addresses and decoded calldata, and require explicit confirmation before any `cast send` command.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:36
• Finding: Unverified Remote Script Is Piped Directly into Bash<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 36-37 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -L https://foundry.paradigm.xyz | bash foundryup ``` ### Technical Analysis The installation instructions pipe content retrieved from an external URL directly into Bash. The effective payload is mutable after the Skill has been reviewed because no release version, artifact digest, or cryptographic signature is pinned or verified. Although the URL uses HTTPS and appears to be an official Foundry distribution endpoint, this pattern relies completely on the ongoing integrity of the domain, its redirect chain, DNS and TLS infrastructure, and the remote distribution service. The `-L` option also follows redirects without requiring the final destination to be reviewed. Any code returned by that request executes immediately with the current user's privileges. This behavior is not required for the Skill's swap functionality. Foundry can instead be installed from a pinned, independently verified release artifact. ### Attack Path 1. An attacker compromises the distribution endpoint, one of its redirect destinations, or relevant delivery infrastructure. 2. The endpoint returns a modified shell script. 3. A user follows the documented prerequisite installation command. 4. `curl` supplies the modified response directly to Bash. 5. The malicious script executes with the user's privileges. 6. It can access resources available to that user, potentially including wallet environment variables, API credentials, local files, and shell configuration. ### Impact Assessment Successful exploitation provides arbitrary code execution under the account running the command. Because the Skill expects `PRIVATE_KEY` and `UNISWAP_API_KEY` environment variables, execution in the same operational environment may expose wallet-signing authority and API credentials. The payload could also modify ...[truncated 237 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | bash` installation pipeline. 2. Pin a specific Foundry release and download its artifact from the official release repository. 3. Verify the artifact against a trusted, published SHA-256 checksum and, where available, a cryptographic signature. 4. Require the user to inspect or extract the downloaded artifact before executing any installer. 5. Avoid silently following arbitrary redirects, or verify that the final download origin is on an explicit allowlist. 6. Document installation in an isolated, unprivileged environment and explicitly warn users not to run the installer as root. 7. Pin and verify the resulting `cast` version before using it for wallet operations. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:88
• Finding: Maximum and Long-Lived Token Allowances Violate Least Privilege<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 88-103 **Vulnerability Type**: Excessive ERC-20 and Permit2 authorization **Risk Level**: High ### Vulnerable Code ```bash cast send <TOKEN_IN> "approve(address,uint256)" \ 0x000000000022D473030F116dDEE9F6B43aC78BA3 \ 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff \ --private-key "$PRIVATE_KEY" --rpc-url "${RPC_URL:-https://rpc.presto.tempo.xyz}" --gas-limit 900000 ``` `Permit2 -> spender` (spender from quote `permitData.values.spender`): ```bash EXP=$(( $(date +%s) + 31536000 )) cast send 0x000000000022D473030F116dDEE9F6B43aC78BA3 \ "approve(address,address,uint160,uint48)" \ <TOKEN_IN> <SPENDER> 1461501637330902918203684832716283019655932542975 "$EXP" \ --private-key "$PRIVATE_KEY" --rpc-url "${RPC_URL:-https://rpc.presto.tempo.xyz}" --gas-limit 900000 ``` ### Technical Analysis The first transaction grants Permit2 the maximum possible ERC-20 allowance. The second grants an externally supplied spender the maximum `uint160` Permit2 allowance for approximately one year. A single exact-input swap requires authorization only for the intended input amount and only for the period needed to complete that operation. Maximum, long-lived approvals therefore exceed the minimum privileges necessary for the declared functionality. The spender is taken from the quote response without an explicit router allowlist in the documented procedure. Consequently, a compromised, manipulated, or incorrectly copied quote can cause the user to authorize an unintended contract. Existing allowances also remain dangerous after the intended swap and may cover tokens deposited into the wallet later. ### Attack Path 1. An attacker compromises the quote service, its API credentials, the response path, or causes a user to substitute a malicious quote object. 2. The manipulated quote supplies an attacker-controlled or malicious spender. 3. The user follows the instructions and grants ...[truncated 1162 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Approve only the exact raw token amount required for the current swap. 2. Use the shortest practical Permit2 expiration rather than a one-year authorization. 3. Validate the spender against a documented allowlist of official router contracts for chain ID 4217. 4. Verify that the approved token, spender, amount, chain, recipient, and expiration match the user's intended transaction. 5. Revoke or reduce both the ERC-20-to-Permit2 allowance and the Permit2-to-spender allowance immediately after the swap. 6. Display current allowances before creating new approvals and avoid replacing small allowances with unlimited ones. 7. Prefer single-use signature-based authorization with appropriate nonce and deadline controls where the protocol supports it. 8. Require explicit confirmation when any requested approval exceeds the exact swap amount. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:105
• Finding: External API-Derived Transaction Target and Calldata Are Broadcast Without Semantic Validation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 105-122 **Vulnerability Type**: Unsafe construction and signing of externally supplied blockchain transactions **Risk Level**: High ### Vulnerable Code ```markdown 3. Build swap tx from quote object (`POST /v1/swap` with `{ "quote": <quote_object> }`), then simulate: ```bash curl -s "${RPC_URL:-https://rpc.presto.tempo.xyz}" -H 'content-type: application/json' --data \ '{"jsonrpc":"2.0","id":1,"method":"eth_call","params":[{"from":"<WALLET>","to":"<SWAP_TO>","data":"<SWAP_DATA>"},"latest"]}' ``` 4. Broadcast: ```bash cast send <SWAP_TO> "<SWAP_DATA>" \ --private-key "$PRIVATE_KEY" \ --rpc-url "${RPC_URL:-https://rpc.presto.tempo.xyz}" \ --gas-limit <GAS_LIMIT> --gas-price <MAX_FEE_PER_GAS> ``` ``` ### Technical Analysis The procedure instructs users to take the transaction target and calldata from an externally generated swap response and sign them with the wallet's private key. It does not require validation of the destination contract, function selector, decoded arguments, chain, input and output tokens, amounts, recipient, slippage bounds, approvals, or native-token value. The documented `eth_call` only tests whether the supplied call executes successfully against the selected state. A successful simulation does not establish that the transaction performs the action the user intended. Malicious calldata can execute successfully while transferring tokens to an attacker, creating additional approvals, or invoking an unintended contract function. Because `<SWAP_TO>` controls the destination and `<SWAP_DATA>` controls the called function and arguments, blindly trusting these fields delegates transaction construction authority to the external response source. ### Attack Path 1. An attacker compromises the trade API, API account, response path, or causes malicious transaction fields to be substituted during the manual workflow. 2. The attacker supplies a malicious `<SWAP_TO>` a ...[truncated 1031 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Maintain an explicit allowlist of approved swap router addresses for Tempo chain ID 4217. 2. Decode calldata before signing and verify the function selector and every security-relevant argument. 3. Confirm the chain ID, destination, input token, output token, exact input amount, minimum output, recipient, deadline, and native-token value. 4. Reject transaction responses containing unknown contracts, selectors, nested calls, recipients, or approval operations. 5. Use a trusted state-diff simulation service or local fork simulation and inspect token balance and allowance changes, rather than relying only on a non-reverting `eth_call`. 6. Compare simulated wallet balance changes against the quote and reject unexpected asset transfers or allowance modifications. 7. Present a decoded transaction summary and require explicit user confirmation before signing. 8. Refresh stale quotes and enforce short deadlines and user-defined slippage limits. 9. Avoid passing a broadly exposed private key through shell commands; use a hardware wallet, isolated signer, or narrowly scoped signing service where possible. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Ae1

High

• Category: analysis-evasion

Content

Use this `SKILL.md` alone. No other files are required.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

External Script Fetching

High

• Category: Supply Chain

Content

Install if missing:

```bash
curl -L https://foundry.paradigm.xyz | bash
foundryup
```

• Confidence: 97% confidence
• Finding: Fetching and executing a remote script with `curl -L https://foundry.paradigm.xyz | bash` is a classic high-risk supply-chain pattern. If the remote content, DNS, TLS path, or hosting account is compromised, arbitrary code can run on the user's machine and steal private keys, alter transaction commands, or persist malware.

Chaining Abuse

High

• Category: Tool Misuse

Content

Install if missing:

```bash
curl -L https://foundry.paradigm.xyz | bash
foundryup
```

• Confidence: 96% confidence
• Finding: The shell pipe into `bash` enables direct execution of unreviewed remote content, chaining network retrieval to code execution in one step. In a crypto-operations skill, this is especially dangerous because a compromised install path can immediately capture secrets and manipulate subsequent approval or swap commands.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to install Foundry via a remote shell pipeline (`curl ... | bash`), which executes network-fetched code without verification. In a skill that already handles private keys and on-chain asset movement, this creates a serious supply-chain compromise path that could lead to wallet or host takeover.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill requires sensitive secrets (`PRIVATE_KEY`, `UNISWAP_API_KEY`) but does not include handling guidance such as avoiding shell history leakage, using least-privilege wallets, or preventing logging/exfiltration. Because the same document also includes network calls and transaction execution, poor secret hygiene here can directly lead to wallet compromise or unauthorized API use.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill provides direct transfer and swap broadcast commands that move funds irreversibly on-chain, but it lacks an explicit warning or confirmation step about financial loss, recipient/address mistakes, slippage, and approval risk. In this context, an agent or operator could execute destructive transactions without appreciating that approval and broadcast steps can permanently expose or transfer assets.

External Transmission

Medium

• Category: Data Exfiltration

Content

1. Quote:

```bash
curl -sS https://trade-api.gateway.uniswap.org/v1/quote \
  -H 'content-type: application/json' \
  -H "x-api-key: $UNISWAP_API_KEY" \
  --data '{

• Confidence: 75% confidence
• Finding: The quote request sends transaction intent metadata, wallet address, token pair, amount, and an API key to an external Uniswap endpoint. While external quoting is expected for this skill's purpose, it still exposes operational and financial metadata to a third party and could enable tracking or misuse if users are not warned.

Static analysis

No suspicious patterns detected.