Security audit
Security checks for vulnerabilities and agentic risk
The skill is not clearly malicious, but it handles real crypto trades while overstating settlement guarantees and leaving important safety and audit behavior under-specified.
Review carefully before installing. Treat this as a tool for user-confirmed Uniswap swaps, not guaranteed bilateral OTC settlement. Do not rely on the counterparty being forced to execute, require a fresh safety check and wallet confirmation before any transaction, verify token addresses and chains manually, and prefer pinned installation sources over the documented mutable commands.
README.md:8Installation Commands Execute Unpinned Third-Party Dependencies
SKILL.md:23Pool Swaps Are Misrepresented as Atomic Bilateral OTC Settlement
SKILL.md:220Declared Safety-Status Check Is Not Enforced Before Asset Execution
The README promotes OTC token trading, identity verification, and cross-chain settlement but does not warn users about irreversible on-chain transactions, smart contract risk, slippage, bridge/intents risk, or the possibility of financial loss. In a crypto trading skill, omission of these warnings can mislead users into treating the workflow as routine automation and increases the chance of unsafe or uninformed execution.
The README instructs users to run npx skills add without pinning a version or commit, which allows whatever package/version is current at execution time to be fetched and run. Because this is an installation path for an agent skill that can influence subsequent behavior, a compromised or malicious upstream package or changed repository state could lead to supply-chain execution of unreviewed code.
The command npx clawhub@latest install agent-otc-trade explicitly tracks the latest published version, which can change over time and execute newly published code without user review. In a security-sensitive crypto/agent workflow, this increases supply-chain risk because an attacker who compromises the package or publishing pipeline could deliver arbitrary code at install time.
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
agent, settle an agent-to-agent trade through Uniswap, or execute an OTC
swap with a specific counterparty agent. Verifies counterparty identity via
ERC-8004, negotiates terms, and settles through Uniswap pools.
model: opus
allowed-tools:
- Task(subagent_type:trade-executor)
- Task(subagent_type:identity-verifier)
The skill markets itself as facilitating agent-to-agent OTC trading with negotiated terms, identity-based trust, and an audit trail, but the described implementation only performs the user's own Uniswap swap. This mismatch can mislead users into believing there is coordinated bilateral settlement or recorded evidence of an agreed trade when neither is actually enforced, creating operational and financial risk.
The skill promises that every OTC trade is recorded and logged, but no allowed tool or workflow step can actually persist trade history. Users may rely on nonexistent records for dispute resolution, compliance, or reputation, leading to false assurances and failed forensic/audit expectations.
The skill states that it records counterparty identity, agreed terms, settlement transaction, and fees, but does not clearly warn users or provide consent and opt-out controls. In a financial context, this can expose sensitive transactional metadata and counterpart relationships without adequate privacy notice.
Presenting universal trade logging as a feature rather than a warning normalizes data collection without informing users of privacy implications. Because OTC trading involves financial counterparties and transaction details, undisclosed or non-consensual logging increases confidentiality and compliance risk.
No suspicious patterns detected.