ClawHub
Back to skill

Security audit

Uniswap Build Hook

Security checks for vulnerabilities and agentic risk

Overview

The skill’s Uniswap hook generation purpose is coherent, but its documented installation and tool setup paths use mutable remote execution patterns that users should review carefully.

Install only from a pinned, reviewed commit or exact package version. Avoid running the pipe-to-bash Foundry installer from the skill text unless you independently trust and verify the official installer. Run this in a clean development workspace, review generated contracts/tests/deployment scripts before use, and keep wallet keys or production RPC credentials out of the environment during generation.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:108
Finding

Unverified Remote Installer Piped Directly into Bash

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
README.md:5
Finding

Mutable and Unpinned npx-Based Skill Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

External Script Fetching

High
Category
Supply Chain
Confidence
95% confidence
Finding

The skill recommends installing Foundry via curl -L https://foundry.paradigm.xyz | bash, which executes a remotely fetched script directly in the shell without verification. If the remote host, transport, or installation script is compromised, users could execute arbitrary code on their machine, and the danger is elevated because this appears as a prescribed remediation step in a development automation skill.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md
| --- | --- | --- |
| `INVALID_CALLBACK_COMBINATION` | "The requested behavior requires conflicting callbacks." | Simplify hook behavior or split into multiple hooks |
| `CREATE2_MINING_TIMEOUT` | "Could not mine a valid CREATE2 address within time limit." | Increase mining time limit or reduce required flags |
| `FORGE_NOT_INSTALLED` | "Foundry (forge) is required but not installed." | Install: `curl -L https://foundry.paradigm.xyz \| bash && foundryup` |
| `VAGUE_REQUIREMENTS` | "Need more detail about the desired hook behavior." | Describe specific behavior (e.g., "limit orders that execute at tick boundaries") |
| `COMPILATION_ERROR` | "Generated contract has compilation errors." | Review error output and adjust requirements |

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The README instructs users to run npx skills add ... without pinning an exact package version or integrity-verified source. This can cause users to execute whatever code is currently published under that package name at install time, creating a supply-chain risk if the package is updated maliciously or compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The command npx clawhub@latest install build-hook uses a floating tag (latest), which explicitly opts into whatever code is most recently published. If the package publisher account or release pipeline is compromised, users may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
Bash(forge:*), Bash(npm:*), Bash(git:*),
  Task(subagent_type:hook-builder),
  mcp__uniswap__get_supported_chains
model: opus
---

# Build Hook

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly states it writes generated Solidity, tests, and deployment scripts directly into the project, but it does not require a clear user confirmation immediately before making file modifications. In a code-generation skill with broad write capability, this can lead to unintended overwrites or insertion of unsafe generated artifacts into a repository without the user's informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.