Security audit

Uniswap API

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for using Uniswap through OOMOL, but it includes unsafe installer commands and routes sensitive transaction payloads through a third-party connector.

Review this before installing. Use a safer, verified installation method for the oo CLI instead of pipe-to-shell commands, and only send Uniswap payloads through OOMOL when you are comfortable sharing wallet, trade, quote, and any permit-signature data with that service. Confirm every create_swap payload carefully before use.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:57
Finding: Unverified Remote Installer Executed Directly by Shell
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:3
Finding: Sensitive Uniswap Transaction Data Routed Through a Third-Party Connector
Content: View full analysis
" --data '' --json ``` The declared actions include: ```markdown - `create_swap` — Create the transaction calldata for a Uniswap swap from a prior quote and optional permit signature. [write] - `get_quote` — Request a Uniswap trade quote for one wallet, token pair, and amount. ``` ### Technical Analysis The Skill requires all Uniswap API operations to be sent through OOMOL's connector rather than directly to Uniswap. Payloads can include wallet addresses, token pairs, amounts, quote information, and an optional permit signature. This routing is disclosed and is consistent with the connector-based design; the reviewed file does not demonstrate covert exfiltration or prove misuse by OOMOL. Nevertheless, it introduces an additional data processor and trust boundary beyond what a direct Uniswap integration requires. The Skill does not state data-retention limits, logging behavior, payload redaction rules, or special controls for signature material. Server-side credential injection reduces exposure of the raw Uniswap API credential to the local agent, but it does not eliminate disclosure of the transaction payload to the intermediary. ### Attack Path 1. A user requests a quote, approval check, or swap transaction. 2. The agent ob ...[truncated 1082 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The skill instructs users to install software via curl -fsSL https://cli.oomol.com/install.sh | bash, which executes a remotely fetched script without verification. If the remote host, network path, or distribution channel is compromised, this can lead to arbitrary code execution on the user's machine with the privileges of the current shell.
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

bash
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux

powershell

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger text says to use this skill for "ANY Uniswap API request" and "Whenever a task involves Uniswap API, use this skill instead of calling the API directly," which is overly broad and can cause the agent to invoke this skill in situations where a narrower, safer, or more appropriate path should be chosen. In practice this increases the chance of unintended tool use, including routing write-capable operations through the skill when the user only asked for analysis or when direct non-tool reasoning would suffice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.