Uniswap Cross Chain Swap

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:47 PM UTC
• Version: 0.1.0

Overview

The skill is coherent with cross-chain token swapping, but it can initiate high-impact financial operations without clearly requiring final user confirmation and its install instructions use mutable remote installers.

Review this carefully before installing. Use pinned, verified installer versions and immutable skill sources where possible. Do not let the skill execute a cross-chain swap until you have reviewed the exact route, token addresses, chain IDs, fees, slippage, minimum received amount, recipient, and final wallet transaction approval; test with a small amount first.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:12

Finding

Unpinned Installation from a Mutable GitHub Branch

Content

View full analysis

Vulnerability Details

File Location: README.md, line 12
Vulnerability Type: Unpinned third-party dependency and mutable remote source
Risk Level: Medium

Complete Code Snippet:

bash

npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/cross-chain-swap

Technical Analysis

The documented installation command invokes the skills package through npx without pinning that package to an exact, reviewed version. It also installs skill content from the mutable main branch of an external GitHub repository rather than an immutable commit.

The effective package code and skill content can therefore change after this audit. Security depends on the continued integrity of the package registry, the skills package, the referenced GitHub account, and the repository. This constitutes an insecure software supply-chain boundary.

Attack Path

1. An attacker compromises the upstream npm package, its publisher account, the GitHub account, or the referenced repository.
2. The attacker publishes a malicious package release or modifies content under the repository's main branch.
3. A user follows the documented installation command.
4. npx retrieves and executes the currently resolved package, which then retrieves mutable repository content.
5. Attacker-controlled installation code can execute with the user's privileges, or attacker-controlled skill instructions can be installed and later loaded by the agent.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user running npx. The attacker could read or modify files accessible to that user, access environment variables and locally available credentials, alter installed agent skills, or introduce malicious instructions affecting later financial operations. The precise scope is constrained by the operating-system privileges and sandboxing applied to the installer.

Remediation

View remediation

Remediation Suggestions

• Pin the skills package to an exact, reviewed version rather than allowing npx to resolve an unspecified release.
• Replace the mutable main branch URL with an immutable, reviewed Git commit hash.
• Verify package provenance, signatures, and integrity hashes before execution.
• Use a trusted installer already installed locally where possible, rather than executing a package fetched at installation time.
• Vendor and audit the skill content when reproducible installation is required.
• Run installation under least privilege and within a restricted environment that does not expose wallet credentials or unrelated secrets.

T08 · Insecure Dependencies

Warning

• Location: README.md:18

Finding

Execution of an Unpinned Latest Installer Release

Content

View full analysis

Vulnerability Details

File Location: README.md, line 18
Vulnerability Type: Mutable third-party package execution
Risk Level: Medium

Complete Code Snippet:

bash

npx clawhub@latest install cross-chain-swap

Technical Analysis

The installation instructions explicitly direct npx to download and execute the latest release of the external clawhub package. The latest distribution tag is mutable and does not identify the package version reviewed during this audit. A future release, compromised publisher account, or registry-level substitution could consequently change the code executed by this command.

Since npx executes the fetched package rather than merely downloading static data, compromise at this dependency boundary can become immediate local code execution.

Attack Path

1. An attacker compromises the clawhub package publisher, registry account, release pipeline, or another relevant upstream distribution component.
2. The attacker publishes a malicious release and assigns it to the latest distribution tag.
3. A user executes the installation command from the README.
4. npx resolves clawhub@latest to the attacker-controlled release, downloads it, and executes its installer.
5. The malicious installer runs under the invoking user's account and may install altered skill content or perform additional unauthorized actions.

Impact Assessment

Exploitation could result in arbitrary command execution with the invoking user's privileges. This may expose user-readable files, environment variables, credentials, agent configuration, and wallet-related material available in the execution environment. It may also permit modification of installed skills, enabling malicious behavior in later sessions. Administrative impact would be possible if the command were run from an elevated account, although the documentation does not explicitly instruct users to do so.

Remediation

View remediation

Remediation Suggestions

• Replace clawhub@latest with an exact, reviewed package version.
• Enforce package integrity verification through a lockfile, cryptographic checksum, signature, or trusted provenance mechanism.
• Review new installer versions before updating the documented pin.
• Avoid executing remotely fetched installers in environments containing sensitive credentials.
• Run the installer with least privilege and restrict filesystem and network access where practical.
• Document the expected package digest and provide a reproducible installation procedure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README promotes cross-chain swaps and bridge monitoring but omits clear warnings that swaps and bridges can be irreversible, incur fees, suffer slippage, and be delayed or fail operationally. Because this skill is explicitly designed for moving tokens across chains, missing safety disclosures can lead users to approve high-risk financial actions without informed consent, increasing likelihood of loss.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to execute an unpinned package via npx skills, which causes code to be fetched and run from the registry without fixing the exact version or integrity. If the package is updated, compromised, or typo-squatted, users could execute unexpected code during installation of a skill that is specifically intended to move funds across chains.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README also recommends npx clawhub@latest, which is effectively unpinned because @latest can change at any time and will execute whatever version is current at install time. In a crypto-related skill, this increases risk because a compromised installer path could misconfigure the skill, inject malicious prompts, or alter workflows tied to asset transfers.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: cross-chain-swap
description: Execute a cross-chain token swap via Uniswap's bridge infrastructure. Handles quoting, safety validation, bridge monitoring, and destination confirmation. Use when the user wants to swap tokens across different chains.
model: opus
allowed-tools: [Task(subagent_type:cross-chain-executor), mcp__uniswap__getSupportedChains, mcp__uniswap__getTokenInfo]
---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The listed activators include broad phrases like "Cross-chain swap," "Swap tokens across chains," and the template-like "Exchange X on chain A for Y on chain B." These lack clear scope constraints or negative examples, which increases the chance of unintended invocation from ordinary user phrasing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.