Uniswap Bridge Tokens

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:46 PM UTC
• Version: 0.1.0

Overview

The skill matches its token-bridging purpose, but it handles irreversible crypto transfers through a delegated executor and documents mutable install commands.

Review this skill before installing. Use a pinned, reviewed version or commit rather than the mutable README commands, and only run it where wallet signing requires clear human confirmation for token, amount, chains, recipient, fees, and final broadcast.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:9

Finding

Unpinned Third-Party Installation Commands Permit Supply-Chain Substitution

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 9–17
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

bash

npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/bridge-tokens

Or via Clawhub:

bash

npx clawhub@latest install bridge-tokens

Technical Analysis

The documented installation procedure retrieves and executes third-party tooling through npx. The clawhub@latest reference is mutable and can resolve to a different package version whenever the command is run. Similarly, the GitHub installation URL references the moving main branch rather than a reviewed commit.

The project provides no exact package versions, commit hashes, integrity digests, signatures, or lockfiles that would bind installation to audited content. Consequently, the effective package manager, installer behavior, and installed skill content may change after this audit without any modification to the reviewed files.

This is an insecure supply-chain practice rather than evidence that the currently referenced upstream projects are malicious.

Attack Path

1. An attacker compromises the relevant npm publisher account, registry distribution path, GitHub repository, or upstream maintainer account.
2. The attacker publishes a malicious version under the mutable latest tag or modifies content reachable through the main branch.
3. A user follows one of the installation commands in README.md.
4. npx downloads and runs the resolved third-party CLI using the user's local privileges.
5. The malicious installer or retrieved content executes or is installed without being cryptographically bound to the version originally reviewed.
6. Depending on the user's permissions, the payload could access or modify files and credentials available to that user or alter the installed agent skill.

Impact Assessment

Successful exploitation may provide ...[truncated 565 chars]

Remediation

View remediation

Remediation Suggestions

• Replace clawhub@latest with an exact, reviewed version.
• Pin GitHub-hosted content to a full commit hash instead of the mutable main branch.
• Publish expected cryptographic checksums or signatures and verify them before installation.
• Document the exact versions and commit identifiers that have undergone security review.
• Use a lockfile or equivalent immutable dependency manifest where supported.
• Review the downloaded package's lifecycle scripts and installer behavior before execution.
• Run installation with least privilege in an isolated environment, without unnecessary credentials or sensitive environment variables.
• Establish an update process that requires review and integrity verification before changing pinned versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to execute npx skills add without pinning a specific package version, which causes npm to resolve and run whatever the latest published package is at install time. That creates a supply-chain risk: if the package is updated maliciously or compromised, users installing the skill may execute attacker-controlled code on their machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The command npx clawhub@latest install bridge-tokens explicitly tracks the latest release rather than a fixed version, so future installs may run different code than the author originally tested. In a wallet/bridging skill context, this is more concerning because users are likely to have credentials, signing tools, or sensitive financial workflows on the same system, increasing the blast radius of a compromised package.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: bridge-tokens
description: Bridge tokens from one chain to another without swapping. Simplified cross-chain transfer where the output token is the same as the input token. Use when the user wants to move tokens between chains.
model: opus
allowed-tools: [Task(subagent_type:cross-chain-executor), mcp__uniswap__getSupportedChains, mcp__uniswap__getTokenInfo]
---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger examples include generic phrases like 'Send tokens to another chain' and 'Bridge tokens', which can match ambiguous user requests and cause this high-risk financial skill to activate too broadly. In a crypto transaction context, overbroad routing increases the chance of unintended execution paths or mistaken delegation into cross-chain fund movement workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.