Uniswap Batch Swap

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:46 PM UTC
• Version: 0.1.0

Overview

This skill matches its stated batch-swap purpose, but it needs review because it can trigger multiple real token trades and its install docs use mutable remote installers.

Install only from a pinned, reviewed version or commit, and use this skill only if your agent or trade executor requires explicit approval before any real swap. Check every token, chain, amount, slippage, gas estimate, and batch total before allowing execution.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:9
• Finding: Installation from a Mutable GitHub Branch Through an Unpinned CLI## Vulnerability Details **File Location**: `README.md`, line 9 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium **Vulnerable Code**: ```bash npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/batch-swap ``` ### Technical Analysis The installation command uses `npx` without pinning the `skills` CLI to a reviewed version and installs skill content from the mutable `main` branch of a remote GitHub repository. Consequently, the code and instructions installed by this command can differ from the content that was originally audited. This creates a supply-chain trust boundary involving both the npm package resolved by `npx` and the GitHub repository. Compromise of either source, or an unreviewed upstream update, could introduce malicious instructions, scripts, or installer behavior. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the GitHub repository, or an authorized repository maintainer. 2. The attacker publishes a modified CLI release or pushes malicious content to the `main` branch. 3. A user follows the documented installation command. 4. `npx` resolves the unpinned CLI, which then retrieves content from the mutable branch. 5. The altered installer or installed skill executes with the invoking user's permissions when installed or subsequently used. ### Impact Assessment Successful exploitation could install modified skill instructions or executable content and potentially run arbitrary code with the privileges of the user invoking `npx`. The resulting scope may include access to files, credentials, environment variables, developer tools, and agent capabilities available to that user. In this project, malicious changes could also affect a workflow intended to initiate financial token swaps.
• Remediation: ## Remediation Suggestions - Pin the `skills` npm package to an exact, reviewed version rather than allowing `npx` to resolve a mutable release. - Replace the GitHub `main` branch reference with an immutable, reviewed commit hash or signed release tag. - Publish and verify cryptographic integrity hashes for downloaded artifacts. - Require signed commits or releases and protect the upstream repository with mandatory review and multi-factor authentication. - Inspect installation packages before execution and avoid lifecycle scripts unless they are explicitly required and audited. - Document the expected package version, repository commit, and integrity value so users can verify the installed content.

T08 · Insecure Dependencies

Warning

• Location: README.md:15
• Finding: Execution of a Mutable Latest-Version Clawhub Installer## Vulnerability Details **File Location**: `README.md`, line 15 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium **Vulnerable Code**: ```bash npx clawhub@latest install batch-swap ``` ### Technical Analysis The command explicitly instructs `npx` to execute the `latest` release of the third-party `clawhub` package. The `latest` npm distribution tag is mutable and may resolve to a different package version over time. Users therefore execute code that was not necessarily part of this audit. The command also identifies the skill only by its registry name, `batch-swap`, without documenting an immutable skill version or integrity digest. A compromised publisher account, package release, registry entry, or upstream skill artifact could alter either the installer or the installed content. ### Attack Path 1. An attacker compromises the `clawhub` package publisher, npm account, registry release process, or relevant skill registry entry. 2. The attacker moves the `latest` tag to a malicious package version or replaces the remotely resolved skill artifact. 3. A user executes the command from the project documentation. 4. `npx` downloads and runs the attacker-controlled package version. 5. Malicious installer code executes with the user's permissions or installs altered skill content that acts when invoked. ### Impact Assessment Exploitation may permit arbitrary code execution under the invoking user's account, subject to operating-system and sandbox restrictions. Accessible resources could include project files, local credentials, environment variables, wallet-related configuration, and tools exposed to the agent environment. A substituted skill could additionally manipulate or misrepresent token-swap operations.
• Remediation: ## Remediation Suggestions - Replace `clawhub@latest` with an exact, audited package version. - Pin `batch-swap` to an immutable skill release or content digest if the registry supports versioning. - Use npm lockfiles and integrity metadata where applicable. - Verify package provenance and signatures before execution. - Review package contents and lifecycle scripts before recommending an `npx` installation command. - Establish a controlled update process in which newer installer and skill versions are audited before documentation pins are changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The README instructs users to execute a remote package via npx without pinning an exact version, which allows whatever package version is current at install time to run arbitrary install-time code. In a high-risk context like a crypto trading skill, this increases supply-chain risk because a compromised or newly published package update could lead to wallet-targeting malware or altered skill installation behavior.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: This installation command uses npx to fetch and execute the latest clawhub package without a pinned version, exposing users to supply-chain compromise if the package is hijacked or a malicious update is published. Because this skill facilitates token swaps and may be installed by users managing real funds, the consequences of a compromised installer are more serious than in a low-risk utility project.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

Task(subagent_type:trade-executor),
  mcp__uniswap__check_safety_status,
  mcp__uniswap__get_agent_balance
model: opus
---

# Batch Swap

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This skill is designed to execute real token swaps that can directly move and convert funds, but it does not require an explicit user-facing warning or confirmation that the actions are real, irreversible trades. In a batch context, the risk is amplified because multiple swaps may execute sequentially, increasing the chance of unintended loss, slippage exposure, or accidental portfolio changes from a single misunderstood request.

Static analysis

No suspicious patterns detected.