Uniswap Design Integration

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:47 PM UTC
• Version: 0.1.0

Overview

This looks like a legitimate Uniswap architecture helper, but it grants broader file-changing authority than its advisory workflow needs and documents mutable remote install commands.

Install only from a reviewed, pinned revision if possible. Before using it on a private repository, consider removing or denying Write and Edit permissions because the skill should only need read/search access and the integration-architect delegation to produce a blueprint.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:8

Finding

Unpinned Remote Installation Dependencies

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:7

Finding

Skill Declares Unnecessary File-Modification Permissions

Content

View full analysis

- Read, Write, Edit, Glob, Grep, Task(subagent_type:integration-architect), mcp__uniswap__get_supported_chains model: opus ``` ### Technical Analysis The Skill's declared purpose is to inspect project context, delegate architectural analysis to `integration-architect`, and return a written integration blueprint. The documented workflow does not require modifying the user's repository. Nevertheless, the Skill authorizes both `Write` and `Edit`. The Skill also declares direct access to `mcp__uniswap__get_supported_chains`, while its own important notes state that it “does not call MCP tools directly.” These capabilities therefore exceed the minimum privileges described by the workflow. Excessive authorization increases the effect of prompt injection, accidental model behavior, or compromised delegated context. Project files read during architecture analysis could contain adversarial instructions that attempt to induce unauthorized modifications. Tool authorization alone does not prove such modifications will occur, but removing unused capabilities materially reduces the reachable impact. The pre-scan warning concerning sensitive network transmission was not confirmed. The reviewed Skill contains no instruction to transmit credentials, private keys, environment variables, or similar secrets to an external endpoint. Delegation of project context is performed through the explicitly declared subagent mechanism, and the reviewed files do not establish that this subagent sends data to an external server. ### Attack Path 1. A user asks the Skill to analyze an existing repository. 2. The repository contains attacker-controlled text crafted to influence the agent or delegated analysis. 3. The Skill reads that content as part of the documented ...[truncated 834 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run npx skills add against a GitHub-hosted skill path without pinning an immutable version such as a commit SHA or release tag. Because npx resolves and executes code dynamically, an upstream compromise, force-push, or malicious repository change could cause users to install and run altered code unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The command npx clawhub@latest install design-integration explicitly tracks the latest published version, which can change at any time and results in execution of unreviewed code at install time. If the package or its distribution channel is compromised, users may run attacker-controlled code simply by following the README.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

Read, Write, Edit, Glob, Grep,
  Task(subagent_type:integration-architect),
  mcp__uniswap__get_supported_chains
model: opus
---

# Design Integration

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The invocation guidance uses open-ended "Activate when the user asks" language with a wide range of generic examples, creating ambiguous boundaries for when this skill should run. In an agent ecosystem, ambiguous routing can lead to inappropriate skill selection, over-collection of context, or giving implementation advice for high-risk systems such as arbitrage bots or DeFi protocols without sufficient safeguards.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrase "Help me integrate Uniswap" is broad enough to match common user requests without clear scoping, which can cause the skill to activate in contexts where more specialized or safer guidance is needed. Over-broad activation increases the chance of unintended delegation and architecture recommendations being applied to mismatched projects, especially in sensitive DeFi contexts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The Important Notes section states the skill 'does not call MCP tools directly,' yet the manifest's allowed-tools includes mcp__uniswap__get_supported_chains. That creates a mismatch between the documented behavior and the declared operational surface of the skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This is an intent/documentation divergence: the note explicitly describes a no-MCP execution model, but the skill definition includes an MCP capability. Even if the tool is unused at runtime, the documentation currently contradicts the declared intent and permitted behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The instruction "Always uses viem (not ethers.js) and Permit2 (not legacy approve)" imposes a mandatory tool choice in natural language rather than offering it as a recommendation or confirming compatibility with the user's stack. This can violate policy expectations around allowing user choice unless the constraint is clearly justified and documented as mandatory for the environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.