Uniswap Build Hook

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:46 PM UTC
• Version: 0.1.0

Overview

The skill’s Uniswap hook generation purpose is coherent, but its documented installation and tool setup paths use mutable remote execution patterns that users should review carefully.

Install only from a pinned, reviewed commit or exact package version. Avoid running the pipe-to-bash Foundry installer from the skill text unless you independently trust and verify the official installer. Run this in a clean development workspace, review generated contracts/tests/deployment scripts before use, and keep wallet keys or production RPC credentials out of the environment during generation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:108
• Finding: Unverified Remote Installer Piped Directly into Bash<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:108` **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Critical ### Vulnerable Code ```markdown | `FORGE_NOT_INSTALLED` | "Foundry (forge) is required but not installed." | Install: `curl -L https://foundry.paradigm.xyz \| bash && foundryup` | ``` ### Technical Analysis The suggested installation command downloads content from an external URL and passes it directly to Bash. The payload is not pinned to a version, inspected before execution, or validated with a cryptographic checksum or signature. Consequently, the code ultimately executed can change after the Skill has been reviewed. Redirect following through `curl -L` also expands the set of remote endpoints that can provide the executable response. Running `foundryup` afterward introduces another remote tool-installation stage. Installing Foundry is relevant to compiling and testing the generated Solidity project, but executing a mutable remote script immediately is not the minimum privilege or minimum trust mechanism necessary to install it. ### Attack Path 1. Forge is unavailable on the user's system. 2. The Skill presents the documented installation command. 3. The user or an automation agent runs the command. 4. `curl` retrieves the current response from `foundry.paradigm.xyz`, following redirects. 5. Bash executes the response immediately without integrity verification. 6. If the hosting service, redirect target, distribution infrastructure, or TLS trust path is compromised, attacker-controlled shell commands execute with the invoking user's privileges. 7. Those commands can access any files, credentials, environment variables, network resources, and development assets available to that user. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account running the installer. The accessible scope may include: - Reading or modifying source repositories and g ...[truncated 594 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | bash` installation pipeline. 2. Pin Foundry to a reviewed, explicit release version. 3. Download the release artifact without executing it immediately. 4. Validate the artifact using a trusted, published SHA-256 checksum or cryptographic signature. 5. Display the source, version, expected checksum, and destination before installation. 6. Require explicit user approval before executing any downloaded installer. 7. Prefer a trusted package manager or manually installed, version-pinned binary where available. 8. Run installation and build operations in an isolated development container or sandbox with no production credentials. 9. Document the exact files and directories the installer is expected to create or modify. A safer workflow should separate download, verification, and execution into distinct commands rather than passing network content directly to a shell. ]]>

T08 · Insecure Dependencies

Error

• Location: README.md:5
• Finding: Mutable and Unpinned npx-Based Skill Installation<![CDATA[ ## Vulnerability Details **File Location**: `README.md:5-15` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```markdown ## Installation Install into Claude Code or Cursor with: ```bash npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/build-hook ``` Or via Clawhub: ```bash npx clawhub@latest install build-hook ``` ``` ### Technical Analysis Both documented installation paths rely on mutable remote components: - The GitHub URL references the `main` branch rather than an immutable commit SHA. Its contents can change after audit. - `npx clawhub@latest` explicitly resolves the latest available package release instead of a reviewed version. - `npx` may download and execute package code when the requested command is not already installed. - No package integrity value, commit verification, signature validation, or expected file manifest is supplied. This creates a supply-chain boundary in which future repository changes, package releases, compromised publisher accounts, registry compromise, or malicious transitive dependencies can alter the behavior executed during installation. Remote installation supports the declared distribution workflow, but mutable package and branch references are not necessary. Exact package versions and immutable repository commits can provide the same functionality with less supply-chain exposure. ### Attack Path 1. An attacker compromises the relevant package publisher, registry package, GitHub repository, maintainer account, or a dependency used by the installation tool. 2. The attacker publishes a malicious `latest` release or modifies content reachable through the `main` branch. 3. A user follows one of the README installation commands. 4. `npx` resolves and executes remotely sourced package code. 5. The installer retrieves or installs the altered Skill content. 6. Malicious package behavior or altered Skill instructions execute within the use ...[truncated 848 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `clawhub@latest` with an exact, reviewed package version. 2. Pin the GitHub source to a full immutable commit SHA instead of `main`. 3. Publish and verify package integrity hashes or cryptographic signatures. 4. Document the expected package publisher, repository, commit, and installed file manifest. 5. Review and lock transitive dependencies used by the installation tooling. 6. Disable package lifecycle scripts where they are unnecessary. 7. Avoid automatically accepting package execution prompts in CI or agent workflows. 8. Run installation in a restricted sandbox without wallet keys, deployment credentials, or production secrets. 9. Require explicit review and approval before upgrading the pinned package version or repository commit. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

External Script Fetching

High

• Category: Supply Chain

Content

| --- | --- | --- |
| `INVALID_CALLBACK_COMBINATION` | "The requested behavior requires conflicting callbacks." | Simplify hook behavior or split into multiple hooks |
| `CREATE2_MINING_TIMEOUT` | "Could not mine a valid CREATE2 address within time limit." | Increase mining time limit or reduce required flags |
| `FORGE_NOT_INSTALLED` | "Foundry (forge) is required but not installed." | Install: `curl -L https://foundry.paradigm.xyz \| bash && foundryup` |
| `VAGUE_REQUIREMENTS` | "Need more detail about the desired hook behavior." | Describe specific behavior (e.g., "limit orders that execute at tick boundaries") |
| `COMPILATION_ERROR` | "Generated contract has compilation errors." | Review error output and adjust requirements |

• Confidence: 95% confidence
• Finding: The skill recommends installing Foundry via `curl -L https://foundry.paradigm.xyz | bash`, which executes a remotely fetched script directly in the shell without verification. If the remote host, transport, or installation script is compromised, users could execute arbitrary code on their machine, and the danger is elevated because this appears as a prescribed remediation step in a development automation skill.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README instructs users to run `npx skills add ...` without pinning an exact package version or integrity-verified source. This can cause users to execute whatever code is currently published under that package name at install time, creating a supply-chain risk if the package is updated maliciously or compromised.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The command `npx clawhub@latest install build-hook` uses a floating tag (`latest`), which explicitly opts into whatever code is most recently published. If the package publisher account or release pipeline is compromised, users may execute attacker-controlled code during installation.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

Bash(forge:*), Bash(npm:*), Bash(git:*),
  Task(subagent_type:hook-builder),
  mcp__uniswap__get_supported_chains
model: opus
---

# Build Hook

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly states it writes generated Solidity, tests, and deployment scripts directly into the project, but it does not require a clear user confirmation immediately before making file modifications. In a code-generation skill with broad write capability, this can lead to unintended overwrites or insertion of unsafe generated artifacts into a repository without the user's informed consent.

Static analysis

No suspicious patterns detected.