ClawHub
Back to skill

Security audit

Uniswap Find Yield

Security checks for vulnerabilities and agentic risk

Overview

This is a focused Uniswap LP yield-ranking skill with no malicious behavior found, but users should be aware of mutable install commands and model cost implications.

Install from a trusted or pinned source when possible, review the separate opportunity-scanner agent before relying on delegated scans, and treat yield rankings as informational rather than guaranteed financial advice.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:10
Finding

Unpinned and Mutable Remote Installation Sources

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 10-16
Vulnerability Type: Unpinned third-party packages and mutable remote skill content
Risk Level: Medium

bash
npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/find-yield

Or via Clawhub:

bash
npx clawhub@latest install find-yield

Technical Analysis

The documented installation methods rely on remotely mutable sources without immutable version or integrity constraints:

  • npx skills does not specify an exact package version.
  • The GitHub installation source references the mutable main branch rather than a commit SHA.
  • npx clawhub@latest explicitly retrieves the latest available package version.

Because npx can download and execute npm package code, the effective installer may differ from the version reviewed during this audit. Likewise, content retrieved from the GitHub main branch can change without modifying this project artifact. No malicious payload is present in the audited files, but these installation instructions create a supply-chain trust boundary that is not protected by version pinning or integrity verification.

Attack Path

  1. An attacker compromises the npm publisher account, package registry distribution, GitHub repository, or another relevant upstream release channel.
  2. The attacker publishes a malicious version of skills or clawhub, or modifies the skill content on the referenced main branch.
  3. A user follows one of the documented installation commands.
  4. npx downloads and executes the current upstream package, while the installer retrieves mutable skill content where applicable.
  5. The malicious installer runs with the invoking user's privileges or installs modified skill instructions for later execution.

Impact Assessment

Successful exploitation could execute arbitrary code with the permissions of the user running npx. Depending on that user's environment, this may permit access to projec ...[truncated 343 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every npm CLI dependency to an exact, reviewed version rather than relying on an implicit current version or the latest tag.
  • Replace the mutable GitHub main reference with an immutable commit SHA or a signed, versioned release artifact.
  • Publish and verify cryptographic integrity hashes or signatures for downloaded packages and skill content.
  • Use a lockfile or equivalent reproducible dependency mechanism where supported.
  • Review fetched artifacts before installation and execute installers in a sandbox or least-privileged environment.
  • Document the expected package versions, source commit, and verification procedure so users can confirm that they are installing the audited artifact.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The README instructs users to execute an unpinned NPX package (npx skills) from the network, which can fetch the latest published version at install time. If that package, one of its transitive dependencies, or the referenced distribution path is compromised, users may run attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The Clawhub installation command uses npx clawhub@latest, which explicitly opts into the newest available version rather than an audited, fixed release. This increases supply-chain risk because any malicious or accidental upstream change can be pulled and executed immediately by users following the README.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: find-yield
description: Find the highest-yield LP pools on Uniswap filtered by risk tolerance and minimum TVL. Use when the user asks about the best yields, highest APY pools, or where to earn fees.
model: opus
allowed-tools: [Task(subagent_type:opportunity-scanner)]
---

Static analysis

No suspicious patterns detected.