Security audit

Cross-Chain Arbitrage CN | 跨链套利

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly aimed at crypto arbitrage, but it can trigger real on-chain fund movement and its installation/execution scoping should be reviewed carefully.

Install only from a reviewed fixed version or commit, avoid granting broad wallet permissions, set explicit maximum trade amounts, use scan-only mode first, and confirm that every proposed swap or bridge is acceptable before funds move.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: README.md:9
Finding: Unpinned npm Installers and Mutable Remote Skill Source
Content: View full analysis
Remediation: View remediation
add npx --yes clawhub@ install cross-chain-arbitrage ``` 2. Replace the mutable GitHub branch URL with an immutable commit reference: ```text https://github.com/wpank/Agentic-Uniswap/tree//.ai/skills/cross-chain-arbitrage ``` 3. Publish and verify cryptographic checksums or signatures for the expected package and skill artifact before installation. 4. Prefer downloading the artifact without executing it, reviewing its contents, and then installing it through a controlled local process. 5. Use a trusted lockfile or internal package mirror to preserve reviewed dependency versions and reduce registry compromise exposure. 6. Run installation under a non-privileged account in a sandbox or container with minimal filesystem and credential access. Do not recommend `sudo` or administrator execution. 7. Add upgrade guidance requiring a new review whenever the pinned npm version, repository commit, checksum, or signature changes. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README states that the skill can optionally execute cross-chain arbitrage but does not prominently warn that this may trigger real on-chain transactions, bridge transfers, gas expenditure, slippage losses, or irreversible asset movement. In the context of cross-chain arbitrage, omission of such warnings increases the chance that a user authorizes financially impactful actions without understanding the risks.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The README instructs users to run npx skills add against a remote repository path without pinning a specific immutable version or commit. If the upstream package or referenced content changes, users may fetch and run different code than expected, creating a supply-chain risk that is especially concerning for a skill related to financial operations.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The README recommends npx clawhub@latest install, which explicitly tracks the latest published package version rather than a reviewed, fixed release. This exposes users to supply-chain compromise or unexpected behavior if the package is updated maliciously or incompatibly, and the risk is amplified because the skill can lead to high-impact on-chain actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The description embeds Chinese trigger terms ("触发词：跨链、套利") as activation language, but the skill does not state that it is region-specific or that users may choose their preferred language/locale. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy issue.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.