Uniswap Manage Liquidity

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:48 PM UTC
• Version: 0.1.0

Overview

This skill is purpose-aligned for Uniswap liquidity management, but it can trigger high-impact wallet transactions without a clear final confirmation for adding liquidity and gives unsafe private-key setup guidance.

Review carefully before installing. Use a pinned, reviewed version rather than mutable install commands; do not place a high-value wallet private key in a project .env file; prefer a hardware wallet, managed signer, or dedicated low-balance wallet. Before any transaction, require the agent to show the exact pool, token amounts, approvals, range, gas estimate, and effects, then wait for explicit confirmation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:10
• Finding: Mutable Remote Sources Used in Installation Commands## Vulnerability Details **File Location**: `README.md:10-16` **Vulnerability Type**: Supply-chain exposure through unpinned remote installation sources **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/manage-liquidity ``` ```bash npx clawhub@latest install manage-liquidity ``` ### Technical Analysis The documented installation commands retrieve and execute mutable remote content. The GitHub installation source references the `main` branch rather than an immutable commit, while the Clawhub command explicitly requests the mutable `latest` release. Consequently, the software installed by these commands can change after this version of the skill has been reviewed. If the upstream repository, package, publishing credentials, or distribution service is compromised, the installation commands could retrieve code that is materially different from the audited files. Because `npx`-based workflows may execute package entry points or lifecycle behavior, malicious upstream changes could result in local code execution. ### Attack Path 1. An attacker compromises the upstream GitHub repository, Clawhub package, maintainer account, or publishing credentials. 2. The attacker modifies the content referenced by the `main` branch or publishes a malicious version selected by `@latest`. 3. A user follows the installation command in `README.md`. 4. The package manager downloads the attacker-controlled version instead of the version originally audited. 5. Malicious installation or lifecycle code executes with the permissions of the user running the command. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the invoking user's account. Depending on that account's permissions and environment, the attacker could access local files, development credentials, wallet configuration, environment variables, and other secrets av ...[truncated 117 chars]
• Remediation: ## Remediation Suggestions - Replace the GitHub `main` branch reference with a reviewed, immutable commit hash. - Pin the Clawhub package to a specific verified version instead of using `@latest`. - Publish and verify cryptographic checksums or signatures for released artifacts. - Document the expected package version and source revision so users can confirm what is being installed. - Where supported, disable package lifecycle scripts during installation and review them separately before enabling execution. - Protect publisher accounts with multi-factor authentication, scoped release credentials, and provenance-enabled builds. - Periodically audit pinned releases and provide an explicit upgrade process rather than silently selecting the newest release.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:234
• Finding: Plaintext Wallet Private-Key Storage Guidance## Vulnerability Details **File Location**: `SKILL.md:234` **Vulnerability Type**: Insecure handling of wallet credentials **Risk Level**: Medium ### Vulnerable Code ```text | Wallet not configured | "No wallet configured for transactions." | Set WALLET_TYPE + PRIVATE_KEY in .env | ``` ### Technical Analysis The skill recommends placing a wallet private key in a plaintext `.env` file. Environment files are commonly exposed through accidental source-control commits, insecure backups, broad filesystem permissions, diagnostic archives, shell tooling, or unrelated processes operating in the same workspace. A blockchain private key is a bearer credential: possession is generally sufficient to authorize transactions, and unauthorized blockchain transactions are normally irreversible. The guidance does not require encryption, restrictive permissions, source-control exclusions, a hardware-backed signer, or use of a dedicated low-value wallet. ### Attack Path 1. A user follows the documented guidance and stores `PRIVATE_KEY` in a project-level `.env` file. 2. The file is accidentally committed, included in a backup or support archive, exposed through permissive filesystem access, or read by another local process. 3. An attacker obtains the private key from the exposed file. 4. The attacker imports the key into a wallet or signing tool. 5. The attacker signs unauthorized transactions, transfers assets, removes liquidity, or uses existing token allowances to access funds. ### Impact Assessment Exposure grants the attacker the wallet's full signing authority rather than access limited to this skill. The attacker may transfer native assets and tokens, manage or close liquidity positions, approve token spending, interact with arbitrary contracts, and potentially drain all assets controlled by the key. The scope includes every supported network on which the same private key is used.
• Remediation: ## Remediation Suggestions - Prefer a hardware wallet, operating-system keychain, encrypted secret manager, or delegated transaction signer. - Avoid requiring raw private keys in project files. - If `.env` compatibility must remain available, clearly label it as unsuitable for production or high-value wallets. - Require `.env` to be excluded through `.gitignore` and other source-control exclusion mechanisms. - Require restrictive filesystem permissions so only the wallet-owning user can read the file. - Recommend a dedicated, low-value wallet with narrowly scoped token allowances. - Prevent private keys and environment-variable values from appearing in logs, errors, prompts, telemetry, or delegated-agent messages. - Add startup checks that reject insecure file permissions and warn when the environment file appears to be tracked by source control. - Provide key-rotation and incident-response instructions for suspected credential exposure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Credential Access

High

• Category: Privilege Escalation

Content

| Error                         | User-Facing Message                                       | Suggested Action                          |
| ----------------------------- | --------------------------------------------------------- | ----------------------------------------- |
| Wallet not configured         | "No wallet configured for transactions."                  | Set WALLET_TYPE + PRIVATE_KEY in .env     |
| Insufficient balance          | "You have X but need Y to add liquidity."                 | Reduce amount or swap for needed tokens   |
| Pool not found                | "No pool found for X/Y at this fee tier."                 | Try different fee tier or check token names|
| Position not found            | "Position #ID not found on this chain."                   | Check chain and position ID               |

• Confidence: 95% confidence
• Finding: Referencing PRIVATE_KEY in .env indicates the skill ecosystem expects or encourages direct access to highly sensitive signing material. In a crypto-transaction skill, compromise of that environment variable would let an attacker fully control the wallet and drain assets, making the credential exposure risk severe in context.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README advertises end-to-end execution of liquidity adds, removals, fee collection, approvals, and range selection, but does not clearly warn that these actions are irreversible on-chain and may grant token spending approvals. In a DeFi skill handling user funds, omission of explicit risk disclosures increases the chance users will authorize unsafe transactions, broad approvals, or poor LP configurations without understanding loss and custody implications.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The README instructs users to execute `npx skills add` without pinning a specific version or immutable commit. That creates a supply-chain risk: users may fetch and run changed code in the future, and in this skill's context that code could influence wallet interactions, approvals, and transaction construction affecting real funds.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The `npx clawhub@latest install manage-liquidity` command uses a moving `latest` target, so users may execute different code over time than what was originally reviewed. Because this skill manages Uniswap liquidity flows and approvals, a compromised or updated installer could materially affect transaction safety and expose user funds.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
name: manage-liquidity
description: Add liquidity, remove liquidity, or collect fees on Uniswap V2/V3/V4 pools. Handles the full flow including pool selection, range optimization, approvals, safety checks, and transaction execution. Use when the user wants to LP, provide liquidity, remove a position, or collect accumulated fees.
model: opus
allowed-tools: [Task(subagent_type:liquidity-manager), Task(subagent_type:pool-researcher), mcp__uniswap__get_positions_by_owner, mcp__uniswap__get_position, mcp__uniswap__check_safety_status]
---

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **Gas costs**: On Ethereum mainnet, LP operations cost $15-50 in gas. Mention this for small positions.
- **Range tradeoffs**: Narrow = higher fees but more rebalancing. Wide = lower fees but less maintenance. Always explain.
- **V2 vs V3**: V2 is "set and forget" with lower returns. V3 requires active management but earns more. Help the user choose.
- **Never auto-execute**: For remove and rebalance, always confirm with the user before executing.

## Error Handling

• Confidence: 90% confidence
• Finding: The presence of 'Never auto-execute' only for remove/rebalance implies other high-impact actions, especially add-liquidity, may execute autonomously after internal checks. Because this skill can make economically meaningful decisions about pool selection, ranges, approvals, and execution, autonomous action in this context can directly cause loss of funds or undesired on-chain commitments.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly forbids auto-execution for remove/rebalance, but its add-liquidity workflow proceeds from parameter collection and safety checks directly to transaction execution without a mandatory final user confirmation. In a financial skill that can approve tokens and submit on-chain transactions, this creates a real risk of unauthorized or unintended asset deployment if the agent mis-parses intent, defaults parameters incorrectly, or selects an unfavorable pool.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The error handling text instructs users to set WALLET_TYPE and PRIVATE_KEY in .env without any warning about the sensitivity of private keys or safer alternatives. In a transaction-executing crypto skill, normalizing direct private-key storage can lead to insecure operator behavior, accidental leakage, or use of hot keys in unsafe environments.

Static analysis

No suspicious patterns detected.