Design Uniswap Hook

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:47 PM UTC
• Version: 0.1.0

Overview

This skill is a design-only Uniswap V4 planning aid with no shipped executable code, but users should be aware of mutable install commands and delegation to a broader hook-building subagent.

Before installing, prefer a pinned ClawHub version or immutable Git commit if available, and review what the local hook-builder subagent is allowed to do. Use this skill for design documents, not as an enforcement boundary preventing code generation by other installed agents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:9

Finding

Unpinned Remote Dependencies in Documented Installation Commands

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 9–15
Vulnerability Type: Supply-chain risk caused by mutable, unverified remote dependencies
Risk Level: Medium

Vulnerable Code

bash

npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/design-hook

Or via Clawhub:

bash

npx clawhub@latest install design-hook

Technical Analysis

The documented installation procedures direct users to retrieve and execute third-party npm tooling without immutable version pins or integrity verification.

The first command retrieves skill content from the mutable main branch of a GitHub repository. The reviewed content can therefore differ from the content installed later. It also relies on the package that npx resolves for the skills command.

The second command explicitly uses the mutable latest npm distribution tag. That tag may be reassigned to a different package release after this audit. Neither command specifies an expected checksum, package signature, commit SHA, or other immutable identity.

This does not establish that the current packages or repository are malicious. However, it creates a supply-chain trust boundary in which later repository changes, package releases, tag reassignment, or compromise of a maintainer or registry account could alter the code executed during installation.

Attack Path

1. An attacker compromises the relevant npm package, package maintainer, GitHub repository, or publishing credentials. Alternatively, an unsafe future release is published through the same mutable source.
2. The attacker changes the package version referenced by latest, modifies content on the repository's main branch, or injects malicious installer behavior into a remotely resolved dependency.
3. A user follows one of the installation commands from README.md.
4. npx downloads and executes the currently resolved third-party package rather than an im ...[truncated 996 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every npm command-line package to an exact, reviewed version instead of relying on implicit resolution or the latest tag.
2. Replace the GitHub main branch reference with an immutable commit SHA or a cryptographically signed release tag.
3. Publish and verify cryptographic checksums or signatures for downloaded skill artifacts.
4. Document the exact expected package versions and repository commit identifiers so users can reproduce the reviewed installation.
5. Recommend downloading and inspecting installation artifacts before execution, particularly when the installer can modify an agent's skill directory.
6. Avoid advising users to run installation commands with administrative privileges.
7. Use lockfiles, provenance attestations, and registry signature verification where supported.
8. Establish a controlled update process in which new package versions and repository revisions are reviewed before the documented pins are changed.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The README instructs users to run npx skills add ... without pinning the package version. Because npx resolves and executes the latest package by default, a compromised publisher account, malicious new release, or dependency hijack could cause arbitrary code to run on the user's machine during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The command npx clawhub@latest install design-hook uses a floating version (latest), which is effectively unpinned remote code execution. If the package or its release channel is compromised, users following the README may execute attacker-controlled code as part of installation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill promises design-only behavior, but its tool permissions include delegation to a broader hook-builder subagent that may be capable of generating code or performing build-related actions. Because the restriction is described only in prompt text and not enforced by capabilities, a prompt-injection or instruction-drift scenario could cause the subagent to exceed the advertised read-only/design-only scope.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md

Read, Glob, Grep,
  Task(subagent_type:hook-builder),
  mcp__uniswap__get_supported_chains
model: opus
---

# Design Hook

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The statement 'no code generation, no file writes' is not technically enforced; the skill still has access to a delegated builder agent, so the safety boundary depends entirely on compliant instruction-following. In adversarial contexts, documentation-only restrictions are weak and can be bypassed, leading to unauthorized code production or other higher-privilege actions inconsistent with user expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.