Uniswap Optimize Lp

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:47 PM UTC
• Version: 0.1.0

Overview

This is a focused liquidity-strategy skill with no bundled executable code, but users should treat its mutable install commands and model selection as operational cautions.

Before installing, prefer a pinned ClawHub/package version and an immutable Git commit instead of @latest or main. Review any lp-strategist, pool-researcher, or risk-assessor agents separately, and treat the output as financial strategy guidance rather than automatic execution.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:11
• Finding: Unpinned Third-Party Packages and Mutable Remote Sources Executed During Installation<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 11–19 **Vulnerability Type**: Unpinned dependency and mutable remote-source execution **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/optimize-lp ``` Or via Clawhub: ```bash npx clawhub@latest install optimize-lp ``` ### Technical Analysis The documented installation procedures use `npx`, which can download and immediately execute third-party npm package code with the invoking user's privileges. The `clawhub@latest` reference explicitly resolves to a mutable package version. The `skills` package is also invoked without an exact version. In addition, the GitHub source points to the mutable `main` branch rather than a reviewed commit SHA. Consequently, the code executed or installed by these commands can change after this project has been audited. The repository does not include a lockfile, integrity checksum, signature-verification procedure, vendored installer, or other mechanism that binds these installation commands to reviewed artifacts. This creates a supply-chain exposure even though no malicious local scripts were identified in the audited project. ### Attack Path 1. An attacker compromises the npm account, package publication pipeline, GitHub repository, or another component of the referenced distribution infrastructure. 2. The attacker publishes malicious code under a newer `clawhub` release, modifies the unversioned `skills` package, or changes content reachable through the GitHub `main` branch. 3. A user follows the installation command from `README.md`. 4. `npx` downloads and executes the mutable third-party package. 5. The malicious installer runs with the permissions of the user who invoked the command and may install additional attacker-controlled content. ### Impact Assessment Successful exploitation may provide arbitrary code execution under the invoking user's account. The attacker ...[truncated 541 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin each npm package to an exact, reviewed version instead of using an omitted version or `@latest`, for example: ```bash npx clawhub@X.Y.Z install optimize-lp ``` 2. Pin the GitHub source to a reviewed immutable commit SHA rather than the mutable `main` branch. 3. Record the reviewed package versions and commit identifiers in the installation documentation. 4. Use lockfiles and package-manager integrity metadata where an installation workflow supports them. 5. Verify package provenance, signatures, and cryptographic checksums before execution where supported. 6. Prefer downloading and inspecting installer artifacts before running them rather than combining retrieval and execution in one command. 7. Execute installation with a non-administrative account and within a restricted environment that limits filesystem, credential, and network access. 8. Establish a controlled update process in which new versions and source commits are reviewed before the documented pins are changed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README instructs users to run `npx skills add ...` without pinning an exact package version. `npx` will fetch and execute the latest published package, so a compromised or malicious future release could run arbitrary code on the user's machine during installation. Because this is an installation step for a developer tool, the exposure is real even though it appears in documentation rather than executable code.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The README also recommends `npx clawhub@latest install optimize-lp`, which explicitly tracks the latest release rather than a fixed, reviewed version. This creates a supply-chain risk: if the package is hijacked or a malicious update is published, users following the documented install command may execute attacker-controlled code. The skill context increases concern because the package installs tooling into an agent environment that may have access to local files, credentials, or repositories.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
name: optimize-lp
description: Get the optimal LP strategy for a token pair — recommends version (V2/V3/V4), fee tier, range width, and rebalance approach based on pair characteristics, historical data, and risk tolerance. Use when the user asks how to LP, what range to use, or which version/fee tier is best.
model: opus
allowed-tools: [Task(subagent_type:lp-strategist)]
---

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Static analysis

No suspicious patterns detected.