Uniswap Create Test Pool

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:46 PM UTC
• Version: 0.1.0

Overview

This skill is a clearly scoped local Uniswap testnet helper, with no embedded executable code or hidden persistence found.

Before installing, prefer a pinned ClawHub package version or a GitHub commit SHA instead of the README’s mutable latest/main examples. Use this only against a local testnet or fork where changing pool state and funding test accounts is intended.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:10

Finding

Unpinned Third-Party Installation Sources

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 10–16
Vulnerability Type: Supply-chain risk caused by mutable, unpinned installation sources
Risk Level: Medium

Vulnerable Code

bash

npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/create-test-pool

bash

npx clawhub@latest install create-test-pool

Technical Analysis

The documented installation procedures depend on mutable external resources without pinning them to reviewed versions or cryptographic integrity values.

The GitHub installation command retrieves the skill from the repository's mutable main branch. Its contents can change after this audit without any corresponding change to the command. The Clawhub command uses npx clawhub@latest, which explicitly executes whichever package release currently carries the latest tag.

Because npx may download and execute package-provided code, users following these instructions must trust the npm registry package, its publisher account, the external repository, and their respective distribution infrastructure. Compromise of any of those components could cause installation or execution of content that was not included in the audited project.

Attack Path

1. An attacker compromises the npm publisher account, GitHub repository, upstream maintainer account, or relevant distribution infrastructure.
2. The attacker publishes a malicious package under the latest tag or modifies the content referenced by the repository's main branch.
3. A user runs one of the installation commands documented in README.md.
4. npx retrieves the current external package and the installer obtains the mutable skill content.
5. The unreviewed version may execute installation-time code or install malicious skill instructions into the user's agent environment.

This path depends on an upstream compromise or malicious upstream update; the audited files themselves do ...[truncated 696 chars]

Remediation

View remediation

Remediation Suggestions

• Replace npx clawhub@latest with an exact, reviewed package version.
• Pin the GitHub installation source to a specific commit SHA rather than the mutable main branch.
• Record and verify cryptographic checksums or package integrity metadata before installation.
• Use lockfiles and reproducible installation procedures where supported.
• Review npm lifecycle scripts and installer behavior before approving a release.
• Prefer trusted organizational repositories and protected release workflows with mandatory review.
• Use signed commits, signed release artifacts, provenance attestations, and automated dependency scanning.
• Run installation in a least-privileged or sandboxed environment, without unnecessary credentials or filesystem access.

Example hardened forms, subject to installer support:

bash

npx clawhub@<reviewed-exact-version> install create-test-pool

bash

npx skills add https://github.com/wpank/Agentic-Uniswap/tree/<reviewed-commit-sha>/.ai/skills/create-test-pool

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The README instructs users to run npx skills add without pinning an exact package version, which causes npm to resolve and execute the latest published package at install time. If the package is compromised, typosquatted, or updated with malicious code, users could execute attacker-controlled code on their systems during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The command npx clawhub@latest install create-test-pool explicitly requests the latest version, which is inherently mutable and can change over time without review. This increases supply-chain risk because a compromised upstream release would be executed immediately by anyone following the README instructions.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

Create pools with specific conditions (thin liquidity, wide spreads, exact tick
  ranges) to test agent behavior under controlled scenarios. Requires a running
  local testnet.
model: sonnet
allowed-tools:
  - mcp__uniswap__deploy_mock_pool
  - mcp__uniswap__fund_test_account

Static analysis

No suspicious patterns detected.