ClawHub
Back to skill

Security audit

Uniswap Analyze Pool

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Uniswap pool-analysis wrapper with install and model-cost cautions, but no evidence of hidden code, persistence, data theft, or trading authority.

Before installing, prefer a reviewed ClawHub release or pin the installer and source reference instead of running mutable npx/latest commands. Also confirm the pool-researcher subagent and the opus model choice are acceptable for your environment and costs. Do not treat the analysis as financial advice or connect wallets/private keys for this skill.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:9
Finding

Unpinned Remote Installation Dependencies

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 9 and 15
Vulnerability Type: Unpinned third-party installation tools and mutable remote Skill content
Risk Level: Medium

Vulnerable Code

bash
npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/analyze-pool
bash
npx clawhub@latest install analyze-pool

Technical Analysis

The documented installation commands retrieve and execute npm-delivered tooling without pinning it to reviewed versions. The second command explicitly selects the mutable latest release of clawhub. The first command also installs Skill content from a mutable GitHub branch path instead of an immutable commit.

Consequently, the components and Skill instructions installed by these commands can change after this audit. A compromise of an npm package, package-publishing account, registry resolution process, GitHub repository, or upstream maintainer account could replace the expected installer or Skill content with attacker-controlled material.

The vulnerable behavior is not triggered merely by loading the two audited Markdown files. Exploitation requires a user to follow one of the documented installation commands.

Attack Path

  1. An attacker compromises the relevant npm publishing account, GitHub repository, upstream maintainer account, or another component in the distribution chain.
  2. The attacker publishes a malicious package version or modifies the Skill content referenced by the mutable branch.
  3. A user runs one of the installation commands from README.md.
  4. npx resolves and executes the unpinned installer package, which may retrieve the modified remote Skill content.
  5. Attacker-controlled installer behavior executes with the permissions of the invoking user, or malicious Skill instructions are installed and later loaded by the agent.

Impact Assessment

A malicious npm installer may execute arbitrary actions ...[truncated 590 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every npm CLI package to an exact, reviewed version rather than using @latest or an implicit current version.
  2. Replace the mutable GitHub branch URL with a reference to a reviewed commit hash or immutable signed release tag.
  3. Verify downloaded artifacts using checksums, provenance attestations, or cryptographic signatures before installation.
  4. Use npm lockfiles and integrity metadata where the installation workflow supports them.
  5. Document the expected package publisher, version, source commit, and integrity value so users can validate the installation.
  6. Run installation in a restricted environment without unnecessary credentials or elevated privileges.
  7. Establish an update process in which new package versions and source commits are reviewed before the pinned references are changed.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The README instructs users to run npx skills add without pinning an exact package version, which can cause execution of whatever package version is currently published at install time. If the upstream package is compromised, typosquatted, or updated with malicious code, users may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The command npx clawhub@latest install analyze-pool uses a mutable tag (latest) rather than an immutable version, so the code executed can change over time without review. This creates a supply-chain risk where a compromised publisher account or malicious release could lead users to run untrusted code.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: analyze-pool
description: Analyze a specific Uniswap pool's performance, liquidity depth, fee APY, and risk factors. Use when the user asks about pool metrics, TVL, volume, or whether a pool is good for LPing.
model: opus
allowed-tools: [Task(subagent_type:pool-researcher)]
---

Static analysis

No suspicious patterns detected.