Uniswap Manage Liquidity
WarnAudited by ClawScan on May 10, 2026.
Overview
The skill is coherent for managing Uniswap liquidity, but it can approve and execute crypto transactions through delegated agents without clearly documented final user confirmation, wallet-scope, or reviewed execution logic.
Review before installing. Only use this skill if you are comfortable with an agent-assisted workflow for crypto transactions, and insist on wallet prompts plus explicit confirmation for every approval and transaction. Avoid unlimited token approvals, verify the pool/range/chain/amounts yourself, and make sure the delegated liquidity-manager and safety-guardian agents are trusted and reviewable.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent could proceed from a broad liquidity request to approvals and live blockchain transactions affecting the user's assets.
The workflow explicitly instructs delegated tooling to make financial choices, approve token spending, and submit on-chain transactions, but the provided flow does not show a mandatory final user confirmation step for the exact transaction details.
Pick the recommended pool ... a. Check and execute token approvals (Permit2) ... e. Execute the transaction
Require explicit user approval immediately before every approval and transaction, showing chain, pool, tokens, amounts, range, spender, allowance, slippage, gas estimate, and transaction data.
Users may not understand which wallet, session, or signing authority the skill will use to approve spending or move liquidity.
The registry contract does not declare wallet/signing authority, even though SKILL.md describes token approvals and transaction execution. That leaves the account permission boundary unclear.
Required env vars: none ... Primary credential: none ... Capability signals: No capability tags were derived.
Declare the wallet/MCP/provider authority required, limit it to explicit user-selected accounts and chains, and document the signing prompts and refusal conditions.
The most sensitive logic may run in external or pre-existing agents whose permissions, safeguards, and provenance are not visible in this package.
High-impact execution and validation are delegated to named agents, but the supplied artifact set contains only README.md and SKILL.md, so the transaction-execution and safety-guardian behavior is not reviewable here.
Each action delegates to the `liquidity-manager` agent for execution, with optional `pool-researcher` delegation ... route through safety-guardian for validation
Include or reference pinned, reviewable definitions for the delegated agents and their allowed tools, especially any component that can sign, submit, or validate transactions.