Uniswap Design Integration

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:47 PM UTC
• Version: 0.1.0

Overview

This looks like a legitimate Uniswap architecture helper, but it grants broader file-changing authority than its advisory workflow needs and documents mutable remote install commands.

Install only from a reviewed, pinned revision if possible. Before using it on a private repository, consider removing or denying Write and Edit permissions because the skill should only need read/search access and the integration-architect delegation to produce a blueprint.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:8
• Finding: Unpinned Remote Installation Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 8–14 **Vulnerability Type**: Unpinned and mutable third-party installation sources **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/design-integration ``` ```bash npx clawhub@latest install design-integration ``` ### Technical Analysis The documented installation commands rely on remotely sourced tooling and mutable upstream content: - `npx clawhub@latest` explicitly resolves and executes the package version currently associated with the `latest` distribution tag. That version can change after this Skill has been reviewed. - The GitHub installation source refers to the mutable `main` branch rather than a reviewed commit SHA. - The commands provide no checksum, lockfile, signature verification, or other integrity constraint for the downloaded components. This creates a supply-chain trust gap between the audited files and the content users may receive later. Although the reviewed project contains no confirmed malicious payload, compromise of the relevant package registry account, npm package, GitHub repository, or maintainer credentials could cause a future installation to execute or install attacker-controlled content. ### Attack Path 1. An attacker compromises a relevant package publisher account, registry artifact, GitHub maintainer account, or upstream repository. 2. The attacker publishes a malicious `clawhub` release under the `latest` tag or modifies content reachable through the repository's `main` branch. 3. A user follows the installation instructions in `README.md`. 4. `npx` downloads and runs the remotely supplied package with the invoking user's permissions, or the installer retrieves modified Skill content from the mutable branch. 5. The malicious installer or installed content can access resources available to that user and can potentially alter the local Skill installation. ### Impact Ass ...[truncated 509 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with a specifically reviewed package version, for example `clawhub@x.y.z`. 2. Pin the GitHub source to an immutable commit SHA rather than the `main` branch. 3. Publish and document expected integrity hashes or signed release artifacts where the installation mechanism supports them. 4. Review the pinned installer and Skill revision before recommending them. 5. Advise users not to run installation commands with administrator or root privileges. 6. Establish a controlled update process in which new versions and commits are reviewed before the documentation is updated. ]]>

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:7
• Finding: Skill Declares Unnecessary File-Modification Permissions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 7–11 **Vulnerability Type**: Excessive tool permissions violating least privilege **Risk Level**: Low ### Vulnerable Code ```yaml allowed-tools: >- Read, Write, Edit, Glob, Grep, Task(subagent_type:integration-architect), mcp__uniswap__get_supported_chains model: opus ``` ### Technical Analysis The Skill's declared purpose is to inspect project context, delegate architectural analysis to `integration-architect`, and return a written integration blueprint. The documented workflow does not require modifying the user's repository. Nevertheless, the Skill authorizes both `Write` and `Edit`. The Skill also declares direct access to `mcp__uniswap__get_supported_chains`, while its own important notes state that it “does not call MCP tools directly.” These capabilities therefore exceed the minimum privileges described by the workflow. Excessive authorization increases the effect of prompt injection, accidental model behavior, or compromised delegated context. Project files read during architecture analysis could contain adversarial instructions that attempt to induce unauthorized modifications. Tool authorization alone does not prove such modifications will occur, but removing unused capabilities materially reduces the reachable impact. The pre-scan warning concerning sensitive network transmission was not confirmed. The reviewed Skill contains no instruction to transmit credentials, private keys, environment variables, or similar secrets to an external endpoint. Delegation of project context is performed through the explicitly declared subagent mechanism, and the reviewed files do not establish that this subagent sends data to an external server. ### Attack Path 1. A user asks the Skill to analyze an existing repository. 2. The repository contains attacker-controlled text crafted to influence the agent or delegated analysis. 3. The Skill reads that content as part of the documented ...[truncated 834 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `Write` and `Edit` from `allowed-tools` because the declared architecture-advisory workflow is read-only. 2. Remove `mcp__uniswap__get_supported_chains` if, as documented, the Skill never invokes MCP tools directly. 3. Restrict the declaration to the minimum required set, such as read/search capabilities and the narrowly scoped `integration-architect` subagent. 4. Explicitly instruct the Skill and subagent to treat repository contents as untrusted data rather than executable instructions. 5. Require explicit user confirmation before enabling any future workflow that needs to modify project files. 6. Limit repository reads and delegated context to files necessary for the requested architecture assessment, avoiding secrets and unrelated configuration. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README instructs users to run `npx skills add` against a GitHub-hosted skill path without pinning an immutable version such as a commit SHA or release tag. Because `npx` resolves and executes code dynamically, an upstream compromise, force-push, or malicious repository change could cause users to install and run altered code unexpectedly.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The command `npx clawhub@latest install design-integration` explicitly tracks the latest published version, which can change at any time and results in execution of unreviewed code at install time. If the package or its distribution channel is compromised, users may run attacker-controlled code simply by following the README.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

Read, Write, Edit, Glob, Grep,
  Task(subagent_type:integration-architect),
  mcp__uniswap__get_supported_chains
model: opus
---

# Design Integration

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The invocation guidance uses open-ended "Activate when the user asks" language with a wide range of generic examples, creating ambiguous boundaries for when this skill should run. In an agent ecosystem, ambiguous routing can lead to inappropriate skill selection, over-collection of context, or giving implementation advice for high-risk systems such as arbitrage bots or DeFi protocols without sufficient safeguards.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrase "Help me integrate Uniswap" is broad enough to match common user requests without clear scoping, which can cause the skill to activate in contexts where more specialized or safer guidance is needed. Over-broad activation increases the chance of unintended delegation and architecture recommendations being applied to mismatched projects, especially in sensitive DeFi contexts.

Description-Behavior Mismatch

Low

• Confidence: 88% confidence
• Finding: The Important Notes section states the skill 'does not call MCP tools directly,' yet the manifest's allowed-tools includes `mcp__uniswap__get_supported_chains`. That creates a mismatch between the documented behavior and the declared operational surface of the skill.

Intent-Code Divergence

Low

• Confidence: 85% confidence
• Finding: This is an intent/documentation divergence: the note explicitly describes a no-MCP execution model, but the skill definition includes an MCP capability. Even if the tool is unused at runtime, the documentation currently contradicts the declared intent and permitted behavior.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The instruction "Always uses viem (not ethers.js) and Permit2 (not legacy approve)" imposes a mandatory tool choice in natural language rather than offering it as a recommendation or confirming compatibility with the user's stack. This can violate policy expectations around allowing user choice unless the constraint is clearly justified and documented as mandatory for the environment.

Static analysis

No suspicious patterns detected.