ClawHub
Back to skill

Security audit

Uniswap Full Lp Workflow

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed DeFi liquidity workflow with explicit approval gates before spending funds, but users should be careful with mutable install commands and live on-chain transaction risk.

Install only from a trusted, pinned source when possible. Before using the skill, confirm the chain, pool, token amounts, approvals, slippage, gas cost, and spending limits; on-chain swaps and LP deposits can permanently move funds even when the skill behaves as intended.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:10
Finding

Unpinned Third-Party Installation Commands Create a Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README describes end-to-end execution of swaps and LP position entry but does not warn that these are irreversible on-chain transactions involving user funds. That omission can mislead users into delegating autonomous financial actions without understanding loss scenarios such as slippage, wrong-chain execution, approval misuse, or permanent capital movement.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The README instructs users to run npx skills add against a remote repository path without pinning a specific immutable version, tag, or commit. That creates a supply-chain risk: if the referenced package/tooling or fetched skill content changes upstream, users may install different code than was originally reviewed, including malicious updates.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

Using npx clawhub@latest install full-lp-workflow pulls the latest published package version at execution time, which is mutable and can introduce unreviewed or compromised code. In a skill that can influence financial actions, this increases the blast radius of a package compromise or malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The usage guidance explicitly encourages a fully managed workflow that scans, risk-checks, and executes on behalf of the user, yet it provides no asset-risk disclosure or mention of required confirmations. In this context, the absence of warnings is especially dangerous because the skill is designed for autonomous capital deployment across DeFi protocols, where mistakes or adversarial conditions can directly cause financial loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The example prompts tell the agent to open positions and deploy capital directly, normalizing live execution without any adjacent cautionary language. Because this skill's purpose is autonomous LP management, such examples materially increase the chance that users trigger real trades and approvals without appreciating irreversible consequences or reviewing parameters.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md
any needed swaps, enters the position, and reports portfolio impact. Use when
  user has capital and wants end-to-end LP management. Most complex multi-agent
  orchestration in the system.
model: opus
allowed-tools:
  - Task(subagent_type:opportunity-scanner)
  - Task(subagent_type:lp-strategist)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 494)May include surrounding context.

md
- **Conditional swap**: Step 4 only executes if the user doesn't already hold the right tokens. If they do, it's skipped entirely.
- **Chain considerations**: If scanning "all" chains, the best opportunity might be on a chain where the user's funds aren't located. The skill should flag this and suggest bridging or narrowing the chain filter.
- **Gas budget**: On Ethereum, the full pipeline (swap + LP) costs $15-50 in gas. For small positions (< $1K), warn that gas costs significantly eat into returns.
- **Never auto-execute**: Despite being an "autonomous" workflow, every spend of user capital requires explicit confirmation.

## Error Handling

Static analysis

No suspicious patterns detected.