Uniswap Full Lp Workflow

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:47 PM UTC
• Version: 0.1.0

Overview

This is a disclosed DeFi liquidity workflow with explicit approval gates before spending funds, but users should be careful with mutable install commands and live on-chain transaction risk.

Install only from a trusted, pinned source when possible. Before using the skill, confirm the chain, pool, token amounts, approvals, slippage, gas cost, and spending limits; on-chain swaps and LP deposits can permanently move funds even when the skill behaves as intended.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:10
• Finding: Unpinned Third-Party Installation Commands Create a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 10–18 **Vulnerability Type**: Unpinned npm tooling and mutable remote Skill source **Risk Level**: Medium ### Vulnerable Code ```markdown Install into Claude Code or Cursor with: ```bash npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/full-lp-workflow ``` Or via Clawhub: ```bash npx clawhub@latest install full-lp-workflow ``` ``` ### Technical Analysis The documented installation procedures use `npx` to download and execute third-party CLI packages without locking all retrieved components to immutable, previously audited versions. The Clawhub command explicitly uses `clawhub@latest`. This mutable version selector can resolve to different package contents over time. The other command installs Skill content from the mutable `main` branch of an external GitHub repository rather than from a specific commit. Consequently, the code or instructions obtained when a user follows the documentation may differ from the content covered by this audit. This is a supply-chain weakness rather than evidence that the currently reviewed files contain a malicious payload. Exploitation would require compromise or malicious modification of an upstream npm package, package publisher, GitHub repository, or distribution channel. ### Attack Path 1. An attacker compromises an upstream npm publisher, registry account, GitHub repository, or another component of the installation supply chain. 2. The attacker publishes a modified version under the mutable `latest` selector or modifies the Skill content available from the repository's `main` branch. 3. A user follows the documented installation instructions. 4. `npx` downloads and runs the currently resolved CLI package, and the installer retrieves the current remote Skill content. 5. The modified installer or Skill executes or installs attacker-controlled behavior with the permissions of the user running the command. ### Impact As ...[truncated 851 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `clawhub@latest` with an explicitly reviewed package version, for example `clawhub@X.Y.Z`. 2. Reference the GitHub-hosted Skill by an immutable commit SHA rather than the mutable `main` branch. 3. Record and verify package integrity hashes or signatures before installation. 4. Use an npm lockfile and a controlled installation process where applicable. 5. Review the complete dependency tree and package lifecycle scripts for the pinned CLI versions. 6. Prefer a trusted internal registry, reviewed release artifact, or similarly controlled distribution channel for security-sensitive Skills. 7. Re-audit the exact pinned artifacts whenever versions or commit references are updated. 8. Document that installation commands should be run with least privilege and never from an administrative or root account unless strictly required. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README describes end-to-end execution of swaps and LP position entry but does not warn that these are irreversible on-chain transactions involving user funds. That omission can mislead users into delegating autonomous financial actions without understanding loss scenarios such as slippage, wrong-chain execution, approval misuse, or permanent capital movement.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The README instructs users to run `npx skills add` against a remote repository path without pinning a specific immutable version, tag, or commit. That creates a supply-chain risk: if the referenced package/tooling or fetched skill content changes upstream, users may install different code than was originally reviewed, including malicious updates.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: Using `npx clawhub@latest install full-lp-workflow` pulls the latest published package version at execution time, which is mutable and can introduce unreviewed or compromised code. In a skill that can influence financial actions, this increases the blast radius of a package compromise or malicious update.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The usage guidance explicitly encourages a fully managed workflow that scans, risk-checks, and executes on behalf of the user, yet it provides no asset-risk disclosure or mention of required confirmations. In this context, the absence of warnings is especially dangerous because the skill is designed for autonomous capital deployment across DeFi protocols, where mistakes or adversarial conditions can directly cause financial loss.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The example prompts tell the agent to open positions and deploy capital directly, normalizing live execution without any adjacent cautionary language. Because this skill's purpose is autonomous LP management, such examples materially increase the chance that users trigger real trades and approvals without appreciating irreversible consequences or reviewing parameters.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

any needed swaps, enters the position, and reports portfolio impact. Use when
  user has capital and wants end-to-end LP management. Most complex multi-agent
  orchestration in the system.
model: opus
allowed-tools:
  - Task(subagent_type:opportunity-scanner)
  - Task(subagent_type:lp-strategist)

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **Conditional swap**: Step 4 only executes if the user doesn't already hold the right tokens. If they do, it's skipped entirely.
- **Chain considerations**: If scanning "all" chains, the best opportunity might be on a chain where the user's funds aren't located. The skill should flag this and suggest bridging or narrowing the chain filter.
- **Gas budget**: On Ethereum, the full pipeline (swap + LP) costs $15-50 in gas. For small positions (< $1K), warn that gas costs significantly eat into returns.
- **Never auto-execute**: Despite being an "autonomous" workflow, every spend of user capital requires explicit confirmation.

## Error Handling

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.