Uniswap Analyze Burn Economics

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:46 PM UTC
• Version: 0.1.0

Overview

The skill is a read-only Uniswap analysis workflow, but its documentation tells users to install it with mutable npx/latest commands that could run different code later.

Review the installation path before using this skill. Prefer an immutable, pinned ClawHub release or exact Git commit instead of running npx commands that resolve latest versions. Once installed from a trusted artifact, the skill appears limited to read-only Uniswap economics research and should not execute burns or handle private credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:10

Finding

Unpinned npm CLI and Mutable Git Branch Used for Skill Installation

Content

View full analysis

Vulnerability Details

File Location: README.md:10
Vulnerability Type: Supply-chain exposure through unpinned executable dependencies and a mutable remote branch
Risk Level: Medium

Vulnerable Code

bash

npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/analyze-burn-economics

Technical Analysis

This installation command has two mutable supply-chain components:

1. npx skills can download and execute the currently resolved version of the third-party skills npm package. No exact package version or verified integrity value is specified.
2. The skill is retrieved from the mutable GitHub main branch rather than an immutable commit.

Consequently, the code executed or installed when a user follows the documentation can differ from the content reviewed during this audit. A compromised npm publisher, npm account, GitHub account, repository, or branch could substitute malicious code after review.

The command is documentation rather than code invoked automatically by this Skill. Exploitation therefore requires a user or automated installation system to run the documented command.

Attack Path

1. An attacker compromises the npm package used by npx, its publisher account, the referenced GitHub repository, or a maintainer account.
2. The attacker publishes a malicious package version or modifies content on the repository's main branch.
3. A user follows the installation command in README.md.
4. npx resolves and executes the unpinned CLI, which retrieves the current mutable repository content.
5. The malicious package or skill content executes during installation or is installed for execution in later agent sessions.

Impact Assessment

Successful exploitation could execute commands with the privileges of the user running npx, modify files accessible to that account, access environment variables or credentials available to the process, and install ma ...[truncated 188 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the npm CLI to an audited exact version instead of relying on implicit package resolution, for example using the package manager's supported exact-version syntax.
• Replace the GitHub main reference with a full, reviewed commit hash or a cryptographically verified signed release.
• Verify the downloaded artifact against a published checksum or signature before installation.
• Run installation with minimal privileges in an isolated environment.
• Add automated dependency and provenance checks to ensure documented installation targets remain approved.
• Document the exact audited CLI version, repository commit, and expected artifact digest.

T08 · Insecure Dependencies

Warning

• Location: README.md:16

Finding

Execution of Mutable Clawhub Latest Release During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md:16
Vulnerability Type: Supply-chain exposure through an unpinned third-party installer
Risk Level: Medium

Vulnerable Code

bash

npx clawhub@latest install analyze-burn-economics

Technical Analysis

The @latest tag explicitly instructs npm to resolve and execute whichever clawhub release currently owns that mutable distribution tag. The command does not pin an audited version or verify package integrity independently.

A future malicious release, compromised publisher account, or unauthorized reassignment of the latest tag could cause users to execute code that was not part of this audit. The installer may also retrieve a current registry copy of analyze-burn-economics, which can differ from the reviewed project unless the installed skill itself is bound to an immutable version and verified digest.

This issue is not automatically triggered by loading the Skill. Exploitation requires the documented installation command to be executed.

Attack Path

1. An attacker compromises the clawhub package publication process, a maintainer account, or another upstream distribution component.
2. The attacker publishes a malicious release and assigns it to the latest tag.
3. A user executes the installation command from README.md.
4. npx downloads and runs the attacker-controlled release.
5. The malicious installer executes under the user's account and may install additional attacker-controlled Skill content.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the invoking user. This may permit access to user-readable files, environment variables, local development credentials, agent configuration, and writable project or Skill directories. It could also introduce persistent malicious Skill instructions that affect later agent invocations. System-wide impact would require the command ...[truncated 82 chars]

Remediation

View remediation

Remediation Suggestions

• Replace clawhub@latest with a reviewed, exact package version.
• Use npm lockfiles, package integrity metadata, or an independently published checksum where supported.
• Pin the installed Skill to an immutable release or content digest rather than resolving its current registry state.
• Prefer signed releases and verify publisher provenance before execution.
• Run the installer in a sandbox with no unnecessary secrets and only the filesystem permissions required for installation.
• Establish a controlled upgrade process in which new installer and Skill versions are reviewed before updating the documented command.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to execute npx skills add ... without pinning the package version. npx will fetch the latest published package at execution time, so a compromised maintainer account, dependency confusion, or malicious future release could cause users to run unexpected code during installation. Because this is an installation command in a security-insensitive setup path, users are likely to copy-paste it directly, which increases exploitability.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The command npx clawhub@latest install analyze-burn-economics uses a moving @latest tag, which means the executed code can change over time without any review by the user. If the package or publishing pipeline is compromised, anyone following the README could execute attacker-controlled code on their machine. The skill context does not mitigate this risk; installation instructions are a common social-engineering vector because users tend to trust project documentation.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

profitability projections. Governance-grade research report. Use when user asks
  "What's the burn economics?", "History of protocol fee burns", or "Average
  profit per burn."
model: opus
allowed-tools:
  - Task(subagent_type:protocol-fee-seeker)
  - mcp__uniswap__get_burn_history

Static analysis

No suspicious patterns detected.