Setup Local Anvil Testnet

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing from a moving remote source could install changed content later if the upstream branch changes.

Why it was flagged

The documented install path fetches from a remote GitHub branch rather than a pinned immutable commit. This is common for skill installation but means the user is trusting that remote source at install time.

Skill content
npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/setup-local-testnet
Recommendation

Install only from sources you trust, and prefer a pinned release or commit when reproducibility matters.

What this means

Running the setup command gives the remote installer control over the local shell environment.

Why it was flagged

The skill suggests a user-directed remote shell installer for Foundry/Anvil if Anvil is missing. This is purpose-aligned, but it executes code downloaded from the network.

Skill content
Install: curl -L https://foundry.paradigm.xyz | bash && foundryup
Recommendation

Review Foundry’s official installation guidance and run the installer only if you trust the source.

What this means

Invoking the skill can start or change a local development blockchain and funded test accounts.

Why it was flagged

The skill grants the agent access to MCP tools that can create and fund a local testnet. This is central to the stated purpose, but it is still local environment mutation.

Skill content
allowed-tools:\n  - mcp__uniswap__setup_local_testnet\n  - mcp__uniswap__fund_test_account
Recommendation

Use it when you intentionally want a local Uniswap test environment, and specify chain, block, account count, and port when those details matter.

What this means

Anyone with those keys can control the local test accounts, and those keys should never be used for real funds.

Why it was flagged

The skill’s expected output includes private keys for local development accounts. These are standard disposable test keys, but they still authorize the corresponding accounts.

Skill content
Private Keys (for wallet config):\n    Account #1: 0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80
Recommendation

Treat the displayed keys as public, disposable development keys and do not reuse them on public networks or with real assets.