ClawHub
Back to skill

Security audit

Uniswap Deploy Agent Token

Security checks for vulnerabilities and agentic risk

Overview

The skill is a clearly described crypto-token deployment helper, but it needs review because it can trigger irreversible on-chain financial actions and its install instructions use mutable remote packages.

Review this before installing because it automates real crypto deployment actions. Use only a pinned, reviewed install source, run it with a dedicated low-privilege wallet, verify every pool, hook, liquidity, price, and LP-lock parameter before signing, and do not let it broadcast transactions without explicit confirmation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:9
Finding

Unpinned Remote Dependencies in Installation Commands

Content
View full analysis
Remediation
View remediation
add ... npx clawhub@ install deploy-agent-token ``` 2. Replace the mutable GitHub `main` branch reference with an immutable, reviewed commit SHA or signed release tag. 3. Publish and verify cryptographic checksums or signatures for downloaded Skill artifacts before installation. 4. Prefer installing reviewed CLI dependencies through a lockfile and then invoking the local pinned binary rather than downloading and executing packages directly through `npx`. 5. Review package lifecycle scripts and the complete dependency tree before approving new versions. 6. Run installation in a least-privileged, isolated environment without production credentials or sensitive environment variables. 7. Establish a controlled update process in which new dependency versions and upstream Skill revisions are audited before documentation is updated. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The README instructs users to run npx skills add ... without pinning an exact package version, which causes execution of whatever version is current at install time. If the upstream package is compromised, typosquatted, or publishes a malicious update, users could execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The command npx clawhub@latest install deploy-agent-token explicitly tracks the latest published version, making the installation non-reproducible and exposing users to supply-chain risk from any future malicious or vulnerable release. Because npx executes package code directly, a compromised publish could immediately affect users following the README.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: deploy-agent-token
description: Deploy an agent token with a Uniswap V4 pool — handles pool creation with configurable hooks (anti-snipe, dynamic fees, revenue share), initial liquidity bootstrapping, LP locking, and post-deployment monitoring. Use when the user wants to launch a token on Uniswap.
model: opus
allowed-tools: [Task(subagent_type:token-deployer)]
---

Static analysis

No suspicious patterns detected.