Uniswap Compare Pools

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:46 PM UTC
• Version: 0.1.0

Overview

This skill is a narrow Uniswap pool comparison workflow with no embedded code, hidden commands, persistence, or credential handling, but its README install snippets use mutable remote installers that users should pin or verify.

Install from a trusted, pinned ClawHub version or verified commit rather than copying mutable npx/latest examples. Expect the skill to send token-pair research to the configured pool-researcher and treat APY or liquidity recommendations as financial research to verify before acting.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:9
• Finding: Unpinned npm CLI and Mutable GitHub Source During Installation## Vulnerability Details **File Location**: `README.md`, line 9 **Vulnerability Type**: Supply-chain risk caused by unpinned executable tooling and a mutable remote source **Risk Level**: Medium **Vulnerable Code**: ```bash npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/compare-pools ``` ### Technical Analysis This installation command relies on two mutable, externally controlled components: 1. `npx skills` does not specify an exact package version, so npm may retrieve and execute a package release that was not covered by this audit. 2. The skill is retrieved from the mutable `main` branch of a personal GitHub repository rather than from a verified commit hash or signed release. Because `npx` can download and execute package code, compromise of the npm package, its maintainer account, the GitHub account, or the repository could change the effective installation behavior after review. No malicious payload was present in the audited Markdown files; this finding concerns the unsafe trust and version-pinning model. ### Attack Path 1. An attacker compromises the npm package, package maintainer account, GitHub repository, or repository owner account. 2. The attacker publishes malicious CLI behavior or modifies content under the repository's `main` branch. 3. A user copies and runs the documented installation command. 4. `npx` downloads and executes the current package code, which then obtains content from the mutable remote branch. 5. The compromised component executes malicious installation logic or installs altered skill instructions with the invoking user's permissions. ### Impact Assessment Successful exploitation could permit arbitrary actions within the privileges of the user running `npx`, including reading or modifying user-accessible files, accessing environment variables or credentials available to the process, making network requests, or installing manipulated agent instructions ...[truncated 114 chars]
• Remediation: ## Remediation Suggestions - Pin the `skills` npm package to an exact, audited version rather than relying on implicit resolution. - Replace the mutable GitHub branch URL with a URL referencing a verified commit hash or immutable signed release. - Publish and verify cryptographic checksums or signatures for the installed skill content. - Review package lifecycle scripts and installer behavior before execution. - Prefer a lockfile-backed installation process or a trusted internal registry where feasible. - Document the expected repository commit and package integrity value so users can verify both before installation.

T08 · Insecure Dependencies

Warning

• Location: README.md:15
• Finding: Execution of Mutable `latest` Clawhub Installer## Vulnerability Details **File Location**: `README.md`, line 15 **Vulnerability Type**: Supply-chain risk caused by executing a mutable npm package release **Risk Level**: Medium **Vulnerable Code**: ```bash npx clawhub@latest install compare-pools ``` ### Technical Analysis The command explicitly resolves `clawhub` through the mutable npm `latest` distribution tag. The package version ultimately downloaded and executed can therefore change after this project has been audited. `npx` executes the resolved third-party CLI locally, creating a code-execution boundary based on the ongoing security of the npm package, registry metadata, and maintainer account. A malicious future release, package takeover, or compromised publishing account could cause users following the README to execute code that was not present during this audit. The audited project itself contains no confirmed embedded malicious code; the vulnerability is the unsafe dependency-installation practice. ### Attack Path 1. An attacker compromises the `clawhub` package, its publisher account, or the relevant npm registry metadata. 2. The attacker publishes a malicious release and assigns it to the `latest` tag. 3. A user runs the installation command from the README. 4. npm resolves `clawhub@latest` to the attacker-controlled release. 5. `npx` downloads and executes that release under the user's account. 6. The malicious installer performs unauthorized actions or installs manipulated skill content. ### Impact Assessment Exploitation could provide code execution with the privileges of the user invoking the command. Potential effects include alteration of local files and agent configuration, access to process-visible secrets, unauthorized network communication, or installation of additional malicious components. Administrator-level impact would require the command to be run from a correspondingly privileged account.
• Remediation: ## Remediation Suggestions - Replace `clawhub@latest` with an exact version that has been reviewed and approved. - Record and verify the npm package integrity hash before execution. - Update pinned versions only through a controlled dependency-review process. - Avoid running the installer with administrator or root privileges. - Consider providing a non-executing download and verification workflow so users can inspect package contents before running installation logic. - Monitor the dependency for ownership changes, unexpected releases, and security advisories.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The README instructs users to run an unpinned `npx skills add ...` command, which fetches and executes whatever package version is current at install time. If the referenced package or one of its dependencies is compromised upstream, users could execute unintended code during installation; the skill context increases risk because this is a developer-facing setup step likely to be copied and run verbatim.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The command `npx clawhub@latest install compare-pools` uses a mutable `@latest` tag, so the code executed can change over time without review. This creates a supply-chain risk where a compromised or malicious future release could run arbitrary code on the user's machine, and README installation snippets are especially dangerous because users commonly trust and paste them directly.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
name: compare-pools
description: Compare all Uniswap pools for a token pair across fee tiers and versions. Use when the user asks which pool is best, wants to compare V3 vs V4, or wants to find the optimal fee tier.
model: opus
allowed-tools: [Task(subagent_type:pool-researcher)]
---

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Static analysis

No suspicious patterns detected.