Uniswap Setup DCA
v0.1.0Set up a non-custodial dollar-cost averaging strategy on Uniswap. Use when user wants to create recurring swaps, auto-buy ETH/BTC/SOL with USDC on a schedule, or build a DCA bot. Covers USDC approval, swap path selection, frequency configuration, Gelato keeper automation, and monitoring. Works on local testnet for development or mainnet for production.
⭐ 0· 690·0 current·0 all-time
by@wpank
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description match the allowed tools and runtime instructions: discovering routes, quoting, approvals, and automation all map to the listed mcp__uniswap__* and trade-executor tools. However, the skill implicitly requires access to a signing wallet (to check balances, create approvals, and submit transactions) even though no credentials, env vars, or config paths are declared — this is plausible on many agent platforms but should be explicit to avoid surprises.
Instruction Scope
The SKILL.md instructs the agent to validate balance, perform Permit2 approvals, execute a first swap, and set up ongoing automation (Gelato). Those are within the DCA purpose, but they are high-impact operations: approvals and swaps change on-chain state and spend funds. The default startImmediately: true and the explicit 'execute the first swap' step mean the agent could perform a real transaction immediately if invoked, which is a safety concern if users do not expect immediate execution.
Install Mechanism
Instruction-only skill with no install spec or code files — lowest installer risk. The README references an npx install command for adding the skill to agent runtimes, but no external downloads or archive extraction are performed by the skill itself.
Credentials
No env vars or credentials are declared, which is consistent with an instruction-only skill, but the functionality clearly requires wallet access and funds (signer, private key, or platform-managed account). The absence of explicit credential/config requirements can be misleading; it's important to confirm how the platform supplies the signer and where keys remain (user-controlled vs. platform-managed).
Persistence & Privilege
always:false and no attempt to modify other skills or system configuration — appropriate. However, disable-model-invocation is false (normal), so the agent could autonomously invoke the allowed trade-execution tools and perform transactions. Combined with the 'startImmediately' default and approval flows, this grants a potentially large financial blast radius if not explicitly confirmed by the user.
What to consider before installing
This skill is coherent with its stated purpose (setting up on-chain DCA) but exercises powerful actions: it will check balances, create Permit2 approvals, and can execute swaps (including an immediate first swap by default). Before installing or running it: 1) Confirm how your agent platform provides a wallet/signer and who controls the private keys. 2) Test on a local testnet or fork first — do not run on mainnet until you understand every transaction. 3) Pay attention to approval scopes (avoid unlimited approvals unless you accept the risk). 4) Be aware that 'startImmediately' defaults to true — disable it if you want to review the first transaction before execution. 5) If you don’t trust autonomous execution, require explicit confirmation for each on-chain transaction or disable autonomous invocation. If you need, ask the skill to show the exact transaction payloads and estimated costs before signing anything.Like a lobster shell, security has layers — review code before you run it.
latestvk977kykzfvdkfj8mdxnt206zy980xwfa
License
MIT-0
Free to use, modify, and redistribute. No attribution required.