Uniswap Compare Pools

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:46 PM UTC
• Version: 0.1.0

Overview

This skill is a narrow Uniswap pool comparison workflow with no embedded code, hidden commands, persistence, or credential handling, but its README install snippets use mutable remote installers that users should pin or verify.

Install from a trusted, pinned ClawHub version or verified commit rather than copying mutable npx/latest examples. Expect the skill to send token-pair research to the configured pool-researcher and treat APY or liquidity recommendations as financial research to verify before acting.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:9

Finding

Unpinned npm CLI and Mutable GitHub Source During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, line 9
Vulnerability Type: Supply-chain risk caused by unpinned executable tooling and a mutable remote source
Risk Level: Medium

Vulnerable Code:

bash

npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/compare-pools

Technical Analysis

This installation command relies on two mutable, externally controlled components:

1. npx skills does not specify an exact package version, so npm may retrieve and execute a package release that was not covered by this audit.
2. The skill is retrieved from the mutable main branch of a personal GitHub repository rather than from a verified commit hash or signed release.

Because npx can download and execute package code, compromise of the npm package, its maintainer account, the GitHub account, or the repository could change the effective installation behavior after review. No malicious payload was present in the audited Markdown files; this finding concerns the unsafe trust and version-pinning model.

Attack Path

1. An attacker compromises the npm package, package maintainer account, GitHub repository, or repository owner account.
2. The attacker publishes malicious CLI behavior or modifies content under the repository's main branch.
3. A user copies and runs the documented installation command.
4. npx downloads and executes the current package code, which then obtains content from the mutable remote branch.
5. The compromised component executes malicious installation logic or installs altered skill instructions with the invoking user's permissions.

Impact Assessment

Successful exploitation could permit arbitrary actions within the privileges of the user running npx, including reading or modifying user-accessible files, accessing environment variables or credentials available to the process, making network requests, or installing manipulated agent instructions ...[truncated 114 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the skills npm package to an exact, audited version rather than relying on implicit resolution.
• Replace the mutable GitHub branch URL with a URL referencing a verified commit hash or immutable signed release.
• Publish and verify cryptographic checksums or signatures for the installed skill content.
• Review package lifecycle scripts and installer behavior before execution.
• Prefer a lockfile-backed installation process or a trusted internal registry where feasible.
• Document the expected repository commit and package integrity value so users can verify both before installation.

T08 · Insecure Dependencies

Warning

• Location: README.md:15

Finding

Execution of Mutable `latest` Clawhub Installer

Content

View full analysis

Vulnerability Details

File Location: README.md, line 15
Vulnerability Type: Supply-chain risk caused by executing a mutable npm package release
Risk Level: Medium

Vulnerable Code:

bash

npx clawhub@latest install compare-pools

Technical Analysis

The command explicitly resolves clawhub through the mutable npm latest distribution tag. The package version ultimately downloaded and executed can therefore change after this project has been audited. npx executes the resolved third-party CLI locally, creating a code-execution boundary based on the ongoing security of the npm package, registry metadata, and maintainer account.

A malicious future release, package takeover, or compromised publishing account could cause users following the README to execute code that was not present during this audit. The audited project itself contains no confirmed embedded malicious code; the vulnerability is the unsafe dependency-installation practice.

Attack Path

1. An attacker compromises the clawhub package, its publisher account, or the relevant npm registry metadata.
2. The attacker publishes a malicious release and assigns it to the latest tag.
3. A user runs the installation command from the README.
4. npm resolves clawhub@latest to the attacker-controlled release.
5. npx downloads and executes that release under the user's account.
6. The malicious installer performs unauthorized actions or installs manipulated skill content.

Impact Assessment

Exploitation could provide code execution with the privileges of the user invoking the command. Potential effects include alteration of local files and agent configuration, access to process-visible secrets, unauthorized network communication, or installation of additional malicious components. Administrator-level impact would require the command to be run from a correspondingly privileged account.

Remediation

View remediation

Remediation Suggestions

• Replace clawhub@latest with an exact version that has been reviewed and approved.
• Record and verify the npm package integrity hash before execution.
• Update pinned versions only through a controlled dependency-review process.
• Avoid running the installer with administrator or root privileges.
• Consider providing a non-executing download and verification workflow so users can inspect package contents before running installation logic.
• Monitor the dependency for ownership changes, unexpected releases, and security advisories.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run an unpinned npx skills add ... command, which fetches and executes whatever package version is current at install time. If the referenced package or one of its dependencies is compromised upstream, users could execute unintended code during installation; the skill context increases risk because this is a developer-facing setup step likely to be copied and run verbatim.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The command npx clawhub@latest install compare-pools uses a mutable @latest tag, so the code executed can change over time without review. This creates a supply-chain risk where a compromised or malicious future release could run arbitrary code on the user's machine, and README installation snippets are especially dangerous because users commonly trust and paste them directly.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: compare-pools
description: Compare all Uniswap pools for a token pair across fee tiers and versions. Use when the user asks which pool is best, wants to compare V3 vs V4, or wants to find the optimal fee tier.
model: opus
allowed-tools: [Task(subagent_type:pool-researcher)]
---

Static analysis

No suspicious patterns detected.