Uniswap Create Test Pool

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:46 PM UTC
• Version: 0.1.0

Overview

This skill is a clearly scoped local Uniswap testnet helper, with no embedded executable code or hidden persistence found.

Before installing, prefer a pinned ClawHub package version or a GitHub commit SHA instead of the README’s mutable latest/main examples. Use this only against a local testnet or fork where changing pool state and funding test accounts is intended.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:10
• Finding: Unpinned Third-Party Installation Sources## Vulnerability Details **File Location**: `README.md`, lines 10–16 **Vulnerability Type**: Supply-chain risk caused by mutable, unpinned installation sources **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/create-test-pool ``` ```bash npx clawhub@latest install create-test-pool ``` ### Technical Analysis The documented installation procedures depend on mutable external resources without pinning them to reviewed versions or cryptographic integrity values. The GitHub installation command retrieves the skill from the repository's mutable `main` branch. Its contents can change after this audit without any corresponding change to the command. The Clawhub command uses `npx clawhub@latest`, which explicitly executes whichever package release currently carries the `latest` tag. Because `npx` may download and execute package-provided code, users following these instructions must trust the npm registry package, its publisher account, the external repository, and their respective distribution infrastructure. Compromise of any of those components could cause installation or execution of content that was not included in the audited project. ### Attack Path 1. An attacker compromises the npm publisher account, GitHub repository, upstream maintainer account, or relevant distribution infrastructure. 2. The attacker publishes a malicious package under the `latest` tag or modifies the content referenced by the repository's `main` branch. 3. A user runs one of the installation commands documented in `README.md`. 4. `npx` retrieves the current external package and the installer obtains the mutable skill content. 5. The unreviewed version may execute installation-time code or install malicious skill instructions into the user's agent environment. This path depends on an upstream compromise or malicious upstream update; the audited files themselves do ...[truncated 696 chars]
• Remediation: ## Remediation Suggestions - Replace `npx clawhub@latest` with an exact, reviewed package version. - Pin the GitHub installation source to a specific commit SHA rather than the mutable `main` branch. - Record and verify cryptographic checksums or package integrity metadata before installation. - Use lockfiles and reproducible installation procedures where supported. - Review npm lifecycle scripts and installer behavior before approving a release. - Prefer trusted organizational repositories and protected release workflows with mandatory review. - Use signed commits, signed release artifacts, provenance attestations, and automated dependency scanning. - Run installation in a least-privileged or sandboxed environment, without unnecessary credentials or filesystem access. Example hardened forms, subject to installer support: ```bash npx clawhub@<reviewed-exact-version> install create-test-pool ``` ```bash npx skills add https://github.com/wpank/Agentic-Uniswap/tree/<reviewed-commit-sha>/.ai/skills/create-test-pool ```

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The README instructs users to run `npx skills add` without pinning an exact package version, which causes npm to resolve and execute the latest published package at install time. If the package is compromised, typosquatted, or updated with malicious code, users could execute attacker-controlled code on their systems during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The command `npx clawhub@latest install create-test-pool` explicitly requests the latest version, which is inherently mutable and can change over time without review. This increases supply-chain risk because a compromised upstream release would be executed immediately by anyone following the README instructions.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

Create pools with specific conditions (thin liquidity, wide spreads, exact tick
  ranges) to test agent behavior under controlled scenarios. Requires a running
  local testnet.
model: sonnet
allowed-tools:
  - mcp__uniswap__deploy_mock_pool
  - mcp__uniswap__fund_test_account

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Static analysis

No suspicious patterns detected.