Uniswap Deploy Agent Token
v0.1.0Deploy an agent token with a Uniswap V4 pool — handles pool creation with configurable hooks (anti-snipe, dynamic fees, revenue share), initial liquidity bootstrapping, LP locking, and post-deployment monitoring. Use when the user wants to launch a token on Uniswap.
⭐ 0· 743·0 current·0 all-time
by@wpank
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name and description match the instructions: it automates pool creation, hook configuration, liquidity bootstrapping, LP locking, and monitoring. However, deploying pools and locking LP tokens necessarily requires signing transactions and access to blockchain RPC endpoints or a wallet; the skill declares no required environment variables (no private key, no RPC URL, no API credentials) and provides no provenance for the subagents it delegates to. That omission is disproportionate for the claimed capabilities and is unexplained.
Instruction Scope
SKILL.md is detailed and stays on-topic (extract params, validate, delegate to token-deployer, simulate, add liquidity, lock LP, monitor, report). The main risk is delegation: it instructs the agent platform to run Task(subagent_type:token-deployer) which in turn uses safety-guardian and lp-strategist. The SKILL.md does not specify how signing authorization, user confirmation, or transaction-building policies are handled, nor does it require explicit user approval before on-chain actions. That grants broad operational discretion to delegated agents unless the platform enforces stricter controls.
Install Mechanism
This is an instruction-only skill with no install spec and no code files — lowest installation risk. There is nothing written to disk by the skill itself. However, the lower install risk does not mitigate the higher operational risk from on-chain actions and delegation to other agents.
Credentials
Deploying and managing liquidity requires credentials (wallet private key or a signing provider, and usually an RPC URL). The skill requests none. That mismatch is a red flag: either the skill expects the platform to provide signing authority implicitly (not documented), or the subagents will request or obtain credentials at runtime in ways not described. The absence of any declared primary credential or required env vars is disproportionate to the claimed on-chain capabilities and increases the risk of accidental key exposure or unauthorized transactions.
Persistence & Privilege
The skill is not marked always:true and is user-invocable only, which is appropriate. It does permit autonomous model invocation by default (platform default), and it delegates to other subagents — combining autonomous invocation with the credential/payment concerns above increases blast radius, but on its own the persistence/privilege settings are not excessive.
What to consider before installing
What to consider before installing:
- This skill claims to perform irreversible on-chain actions (create pools, add liquidity, transfer/lock LP NFTs). That requires signing with a wallet and access to an RPC — but the skill declares no place for those credentials. Ask: where and how will transactions be signed? Never supply private keys to untrusted code; prefer signing via an external hardware wallet or an isolated signing service.
- The skill delegates all critical work to subagents (token-deployer, safety-guardian, lp-strategist). You should verify the source code and provenance of those subagents before use. The package has unknown origin and no homepage; prefer skills that link to an audited repository.
- Test thoroughly on a testnet with small funds first. Confirm the agent requires explicit user confirmation for any on-chain transaction and review the full deployment report before signing.
- If you must proceed: ensure the platform's policy forces interactive confirmation for transactions, route signing through a secure wallet provider (not pasted private keys), and monitor transactions closely. If you cannot verify where signing occurs or the subagents' code, do not run this with real funds.
What would change this assessment:
- A clear link to a public repository and subagent code for review; explicit declarations of required credentials and how signing is performed (e.g., use of external signing service/hardware wallet); documented user confirmation steps; or platform-enforced signing policies that prevent key exfiltration. With those in place this could be reclassified to benign with high confidence.Like a lobster shell, security has layers — review code before you run it.
latestvk970ceygqpx1v9yg4ckjaj0e4s80wkb4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.