ClawHub
Back to skill

Security audit

Uniswap Assess Risk

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Uniswap risk-assessment skill with no embedded execution or persistence, but users should notice the broad trigger wording and unpinned install examples.

Install from a reviewed, pinned ClawHub version or immutable commit when possible, and use this skill only as an advisory Uniswap risk check. It does not execute trades, but its APPROVE/VETO language should not replace independent financial review or wallet-level confirmation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:9
Finding

Unpinned Third-Party Installation Commands Create a Mutable Supply-Chain Risk

Content
View full analysis
Remediation
View remediation
install assess-risk npx --yes skills@ add ``` 2. Replace the mutable GitHub `main` branch URL with an immutable commit reference: ```text https://github.com/wpank/Agentic-Uniswap/tree//.ai/skills/assess-risk ``` 3. Publish and verify cryptographic checksums or signatures for the expected skill files before installation. 4. Document the exact package versions, Git commit, and expected file hashes that were subjected to security review. 5. Configure automated dependency monitoring while requiring manual security review before updating pinned versions or commit references. 6. Where feasible, download and inspect installation artifacts before execution rather than directly executing remotely resolved npm packages. 7. Run installation under a least-privileged account or sandbox without access to production credentials, SSH keys, wallets, or unrelated repositories. ]]>

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The README instructs users to run an unpinned npx skills add ... command, which fetches and executes code from the package registry without locking the exact package version. If the referenced package or one of its dependencies is compromised or a malicious update is published, users installing the skill could execute attacker-controlled code on their machine.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The command npx clawhub@latest install assess-risk explicitly tracks the latest published version, which is a moving target and can execute newly published code at install time. This increases supply-chain risk because a compromised publisher account or malicious release could cause arbitrary code execution on systems following the README instructions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description says to use the skill whenever a user asks if something is safe or wants a risk evaluation, which is broader than the actual Uniswap-focused scope. This can cause the orchestrator to invoke the skill for unrelated safety or financial questions, leading to incorrect delegation, misleading advice, or displacement of a more appropriate specialist skill.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: assess-risk
description: Get an independent risk assessment for any proposed Uniswap operation — swap, LP position, bridge, or token interaction. Evaluates slippage, impermanent loss, liquidity, smart contract, and bridge risks with a clear APPROVE or VETO decision. Use when the user asks if something is safe or wants a risk evaluation.
model: opus
allowed-tools: [Task(subagent_type:risk-assessor)]
---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger example 'Is this trade safe?' is highly generic and can match a wide range of trading contexts outside Uniswap, including centralized exchange trades, non-crypto trades, or general investment advice. Over-broad examples increase accidental activation and may result in the skill presenting an authoritative APPROVE/VETO decision in contexts where it lacks the right data or domain coverage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.