ClawHub
Back to skill

Security audit

Uniswap Cross Chain Arbitrage

Security checks for vulnerabilities and agentic risk

Overview

The skill is a clearly disclosed cross-chain arbitrage workflow with real financial risk, but it includes user selection, confirmation, risk checks, and scan-only behavior rather than hidden or automatic fund movement.

Install only from a source and version you trust, prefer pinned package versions or a reviewed commit, and use scan-only mode unless you are ready to approve real on-chain transactions. Before execution, confirm the route, amount, chain, costs, slippage, bridge risk, and worst-case loss because blockchain transactions can spend funds and may be irreversible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:9
Finding

Unpinned Installation Tools and Mutable Skill Source

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 9-17
Vulnerability Type: Supply-chain risk caused by unpinned dependencies and mutable remote sources
Risk Level: Medium

Vulnerable Code

bash
npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/cross-chain-arbitrage

Or via Clawhub:

bash
npx clawhub@latest install cross-chain-arbitrage

Technical Analysis

The documented installation commands retrieve and run npm-distributed installation tools without pinning them to reviewed, immutable versions. The second command explicitly uses clawhub@latest, while the first invokes skills without an exact package version. Depending on npm resolution behavior, both may execute a release different from the one reviewed.

The GitHub installation source also references the mutable main branch rather than a specific commit. Consequently, the content installed by a future invocation can differ from the content covered by this audit.

This creates a time-of-review versus time-of-installation discrepancy. Compromise of the npm packages, package-publisher accounts, registry distribution path, GitHub repository, or repository maintainer account could cause users to retrieve and install attacker-controlled content.

The commands appear in installation documentation and are not automatically executed by the audited skill. Exploitation therefore requires a user or automation system to follow the documented installation procedure.

Attack Path

  1. An attacker compromises an upstream npm publisher, npm package, GitHub repository, or associated maintainer account.
  2. The attacker publishes a malicious release under the unpinned package name, changes the release selected by @latest, or modifies content on the GitHub main branch.
  3. A user follows the installation instructions in README.md.
  4. npx downloads and executes the currently resolved installer package rat ...[truncated 1194 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every npm installation tool to an exact reviewed version, for example package-name@X.Y.Z; do not use @latest or an omitted version.
  2. Pin the GitHub source to a specific reviewed commit hash instead of the mutable main branch.
  3. Generate and publish integrity hashes or signed release artifacts for the installer and skill package.
  4. Verify package signatures, provenance attestations, and integrity metadata before execution.
  5. Use a lockfile or an equivalent reproducible installation mechanism for all transitive dependencies.
  6. Run installation in a sandbox or minimally privileged environment without wallet secrets, production credentials, or unnecessary filesystem access.
  7. Review updates before changing pinned versions, and document the commit and package versions covered by each security audit.
  8. Avoid invoking downloaded packages directly through npx in sensitive environments. Prefer a separately verified installer artifact or install the pinned package without lifecycle scripts before executing it.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README presents trade execution as an optional feature without clearly warning that it can move real funds, incur irreversible losses, and trigger blockchain transactions with direct financial consequences. In the context of a cross-chain arbitrage skill, this omission is more dangerous because execution spans multiple chains and bridges, increasing operational complexity, settlement risk, and loss scenarios.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The README instructs users to run an unpinned NPX package (npx skills) fetched at execution time, which creates a supply-chain risk if the package is updated maliciously, compromised, or typo-squatted. Because this command is part of installation flow, exploitation could lead to arbitrary code execution on the user's machine before they inspect the skill contents.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The README also uses an unpinned NPX installer (npx clawhub@latest), and @latest is effectively unpinned because it resolves to whatever version is current at install time. If the package publisher account or dependency chain is compromised, users could execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The example prompt explicitly encourages the agent to execute profitable arbitrage trades without stating that execution should require a separate confirmation step or operator approval. Given this skill's purpose is autonomous financial action across chains, such prompting can normalize unsafe use and increase the chance of unintended or inadequately reviewed real-money transactions.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
chains, evaluates profitability after all costs (gas, bridge fees, slippage),
  assesses risk, and executes if profitable. Uses ERC-7683 for cross-chain
  settlement. Supports scan-only mode for research without execution.
model: opus
allowed-tools:
  - Task(subagent_type:opportunity-scanner)
  - Task(subagent_type:risk-assessor)

Static analysis

No suspicious patterns detected.