Uniswap Find Yield

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:47 PM UTC
• Version: 0.1.0

Overview

This is a focused Uniswap LP yield-ranking skill with no malicious behavior found, but users should be aware of mutable install commands and model cost implications.

Install from a trusted or pinned source when possible, review the separate opportunity-scanner agent before relying on delegated scans, and treat yield rankings as informational rather than guaranteed financial advice.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:10
• Finding: Unpinned and Mutable Remote Installation Sources## Vulnerability Details **File Location**: `README.md`, lines 10-16 **Vulnerability Type**: Unpinned third-party packages and mutable remote skill content **Risk Level**: Medium ```bash npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/find-yield ``` Or via Clawhub: ```bash npx clawhub@latest install find-yield ``` ### Technical Analysis The documented installation methods rely on remotely mutable sources without immutable version or integrity constraints: - `npx skills` does not specify an exact package version. - The GitHub installation source references the mutable `main` branch rather than a commit SHA. - `npx clawhub@latest` explicitly retrieves the latest available package version. Because `npx` can download and execute npm package code, the effective installer may differ from the version reviewed during this audit. Likewise, content retrieved from the GitHub `main` branch can change without modifying this project artifact. No malicious payload is present in the audited files, but these installation instructions create a supply-chain trust boundary that is not protected by version pinning or integrity verification. ### Attack Path 1. An attacker compromises the npm publisher account, package registry distribution, GitHub repository, or another relevant upstream release channel. 2. The attacker publishes a malicious version of `skills` or `clawhub`, or modifies the skill content on the referenced `main` branch. 3. A user follows one of the documented installation commands. 4. `npx` downloads and executes the current upstream package, while the installer retrieves mutable skill content where applicable. 5. The malicious installer runs with the invoking user's privileges or installs modified skill instructions for later execution. ### Impact Assessment Successful exploitation could execute arbitrary code with the permissions of the user running `npx`. Depending on that user's environment, this may permit access to projec ...[truncated 343 chars]
• Remediation: ## Remediation Suggestions - Pin every npm CLI dependency to an exact, reviewed version rather than relying on an implicit current version or the `latest` tag. - Replace the mutable GitHub `main` reference with an immutable commit SHA or a signed, versioned release artifact. - Publish and verify cryptographic integrity hashes or signatures for downloaded packages and skill content. - Use a lockfile or equivalent reproducible dependency mechanism where supported. - Review fetched artifacts before installation and execute installers in a sandbox or least-privileged environment. - Document the expected package versions, source commit, and verification procedure so users can confirm that they are installing the audited artifact.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The README instructs users to execute an unpinned NPX package (`npx skills`) from the network, which can fetch the latest published version at install time. If that package, one of its transitive dependencies, or the referenced distribution path is compromised, users may run attacker-controlled code during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The Clawhub installation command uses `npx clawhub@latest`, which explicitly opts into the newest available version rather than an audited, fixed release. This increases supply-chain risk because any malicious or accidental upstream change can be pulled and executed immediately by users following the README.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
name: find-yield
description: Find the highest-yield LP pools on Uniswap filtered by risk tolerance and minimum TVL. Use when the user asks about the best yields, highest APY pools, or where to earn fees.
model: opus
allowed-tools: [Task(subagent_type:opportunity-scanner)]
---

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Static analysis

No suspicious patterns detected.