Uniswap Batch Swap

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:46 PM UTC
• Version: 0.1.0

Overview

This skill matches its stated batch-swap purpose, but it needs review because it can trigger multiple real token trades and its install docs use mutable remote installers.

Install only from a pinned, reviewed version or commit, and use this skill only if your agent or trade executor requires explicit approval before any real swap. Check every token, chain, amount, slippage, gas estimate, and batch total before allowing execution.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:9

Finding

Installation from a Mutable GitHub Branch Through an Unpinned CLI

Content

View full analysis

Vulnerability Details

File Location: README.md, line 9
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

bash

npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/batch-swap

Technical Analysis

The installation command uses npx without pinning the skills CLI to a reviewed version and installs skill content from the mutable main branch of a remote GitHub repository. Consequently, the code and instructions installed by this command can differ from the content that was originally audited.

This creates a supply-chain trust boundary involving both the npm package resolved by npx and the GitHub repository. Compromise of either source, or an unreviewed upstream update, could introduce malicious instructions, scripts, or installer behavior.

Attack Path

1. An attacker compromises the npm package, its publisher account, the GitHub repository, or an authorized repository maintainer.
2. The attacker publishes a modified CLI release or pushes malicious content to the main branch.
3. A user follows the documented installation command.
4. npx resolves the unpinned CLI, which then retrieves content from the mutable branch.
5. The altered installer or installed skill executes with the invoking user's permissions when installed or subsequently used.

Impact Assessment

Successful exploitation could install modified skill instructions or executable content and potentially run arbitrary code with the privileges of the user invoking npx. The resulting scope may include access to files, credentials, environment variables, developer tools, and agent capabilities available to that user. In this project, malicious changes could also affect a workflow intended to initiate financial token swaps.

Remediation

View remediation

Remediation Suggestions

• Pin the skills npm package to an exact, reviewed version rather than allowing npx to resolve a mutable release.
• Replace the GitHub main branch reference with an immutable, reviewed commit hash or signed release tag.
• Publish and verify cryptographic integrity hashes for downloaded artifacts.
• Require signed commits or releases and protect the upstream repository with mandatory review and multi-factor authentication.
• Inspect installation packages before execution and avoid lifecycle scripts unless they are explicitly required and audited.
• Document the expected package version, repository commit, and integrity value so users can verify the installed content.

T08 · Insecure Dependencies

Warning

• Location: README.md:15

Finding

Execution of a Mutable Latest-Version Clawhub Installer

Content

View full analysis

Vulnerability Details

File Location: README.md, line 15
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

bash

npx clawhub@latest install batch-swap

Technical Analysis

The command explicitly instructs npx to execute the latest release of the third-party clawhub package. The latest npm distribution tag is mutable and may resolve to a different package version over time. Users therefore execute code that was not necessarily part of this audit.

The command also identifies the skill only by its registry name, batch-swap, without documenting an immutable skill version or integrity digest. A compromised publisher account, package release, registry entry, or upstream skill artifact could alter either the installer or the installed content.

Attack Path

1. An attacker compromises the clawhub package publisher, npm account, registry release process, or relevant skill registry entry.
2. The attacker moves the latest tag to a malicious package version or replaces the remotely resolved skill artifact.
3. A user executes the command from the project documentation.
4. npx downloads and runs the attacker-controlled package version.
5. Malicious installer code executes with the user's permissions or installs altered skill content that acts when invoked.

Impact Assessment

Exploitation may permit arbitrary code execution under the invoking user's account, subject to operating-system and sandbox restrictions. Accessible resources could include project files, local credentials, environment variables, wallet-related configuration, and tools exposed to the agent environment. A substituted skill could additionally manipulate or misrepresent token-swap operations.

Remediation

View remediation

Remediation Suggestions

• Replace clawhub@latest with an exact, audited package version.
• Pin batch-swap to an immutable skill release or content digest if the registry supports versioning.
• Use npm lockfiles and integrity metadata where applicable.
• Verify package provenance and signatures before execution.
• Review package contents and lifecycle scripts before recommending an npx installation command.
• Establish a controlled update process in which newer installer and skill versions are audited before documentation pins are changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to execute a remote package via npx without pinning an exact version, which allows whatever package version is current at install time to run arbitrary install-time code. In a high-risk context like a crypto trading skill, this increases supply-chain risk because a compromised or newly published package update could lead to wallet-targeting malware or altered skill installation behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This installation command uses npx to fetch and execute the latest clawhub package without a pinned version, exposing users to supply-chain compromise if the package is hijacked or a malicious update is published. Because this skill facilitates token swaps and may be installed by users managing real funds, the consequences of a compromised installer are more serious than in a low-risk utility project.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md

Task(subagent_type:trade-executor),
  mcp__uniswap__check_safety_status,
  mcp__uniswap__get_agent_balance
model: opus
---

# Batch Swap

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This skill is designed to execute real token swaps that can directly move and convert funds, but it does not require an explicit user-facing warning or confirmation that the actions are real, irreversible trades. In a batch context, the risk is amplified because multiple swaps may execute sequentially, increasing the chance of unintended loss, slippage exposure, or accidental portfolio changes from a single misunderstood request.

Content

No source excerpt is available for this finding.