流动性管理工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:40 AM UTC
• Version: 1.0.1

Overview

The skill is not clearly malicious, but it mixes crypto-wallet liquidity actions with mismatched triggers, broad write/change language, and under-scoped command guidance.

Install only if you intentionally want an agent-assisted Uniswap liquidity helper and can keep it constrained. Use a low-privilege environment, pin and review dependencies, never expose private keys to the agent, require manual review of every transaction before signing, and ignore the unrelated design-task trigger.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:241

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:241
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown

| ethers.js | Chain interaction | Required | `npm install ethers` |

Technical Analysis

The skill instructs users or agents to install ethers without specifying an exact version, lockfile, integrity hash, trusted registry, or dependency-review procedure. Consequently, the installed package and its transitive dependencies may differ over time from those assessed during this audit.

npm installation can also execute package lifecycle scripts unless explicitly disabled. In a wallet-enabled environment, a compromised package release or transitive dependency could run with the privileges of the user or agent performing the installation.

This finding concerns unsafe dependency acquisition rather than evidence that the current ethers package is malicious. The audited project contains no package manifest, lockfile, vendored dependency, or implementation with which to verify a fixed dependency graph.

Attack Path

1. A user or AI agent follows the documented npm install ethers instruction.
2. npm resolves the current mutable release and its transitive dependency graph from the configured registry.
3. An attacker has compromised a resolved package, dependency, maintainer account, or registry response.
4. npm downloads the compromised component and may execute its installation lifecycle scripts.
5. The malicious component executes under the installing user's permissions.
6. In the documented wallet and RPC environment, it may attempt to read accessible wallet configuration, RPC credentials, environment variables, local files, or transaction data and misuse them within the user's privilege boundary.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the user or agent running npm. The a ...[truncated 361 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the floating installation command with an exact, reviewed version, such as npm install --save-exact ethers@<reviewed-version>.
2. Commit a generated lockfile and use npm ci so installations reproduce the reviewed dependency graph.
3. Record and verify registry and package integrity metadata.
4. Use npm ci --ignore-scripts when dependency functionality permits; otherwise, review all lifecycle scripts before installation.
5. Run dependency installation in an isolated, least-privileged environment without wallet secrets.
6. Separate dependency installation and untrusted computation from wallet signing. Expose signing through a narrowly scoped interface requiring explicit transaction review and confirmation.
7. Add automated dependency vulnerability, provenance, and unexpected dependency-change checks to the release process.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The trigger description is both unrelated to the skill domain and overly broad, making accidental or inappropriate activation highly likely. Because the skill permits exec and write-capable workflows in a DeFi context, bad routing can escalate into unintended command execution, wallet-related actions, or misleading financial assistance outside the user's request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The phrase 'Use when 用户需要liquidity-mgr-tool-free相关功能时使用' is circular and does not concretely define what user requests should trigger the skill. Without specific trigger phrases or constraints, it provides little boundary against unintended invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description states '支持中文交互', and the file consistently presents the skill as Chinese-only without offering a language choice or documenting a justified locale restriction. This can violate language/locale policy when users have not opted into that language.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest and overview position this as a basic personal liquidity tool, but the body advertises broad create/modify/delete/import/export/save operation modes through generic parameters. That mismatch can mislead an agent or user about the real action surface and may enable higher-risk file or state-changing behavior than the declared scope suggests.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The trigger condition says to use the skill for design/visual-creation tasks, which is unrelated to Uniswap liquidity management. In an agent routing context, this can cause the skill to be invoked for the wrong user intents, exposing finance-oriented tooling and command execution pathways in contexts where they are not expected.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 66% confidence

Finding

The skill claims coverage of Uniswap V2/V3/V4 position management, including add/remove operations, while the concrete operational examples are mostly V3-focused and the free-version description emphasizes simple single-position management. This creates a possible overclaim about actual supported behavior, especially for V4 management, relative to the limited, basic-scope positioning in the manifest.

Content

No source excerpt is available for this finding.