ClawHub
Back to skill

Security audit

Uniswap Portfolio Report

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly coherent Uniswap portfolio reporting skill, but it unnecessarily points users toward configuring a wallet private key and uses mutable install commands.

Review before installing. Use a public wallet address for reporting and avoid entering a private key or seed phrase for this skill. Prefer a pinned or signed install source, and verify the delegated portfolio-analyst agent is trusted because this skill relies on it for the actual analysis.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:80
Finding

Unnecessary Private-Key Configuration for Read-Only Portfolio Analysis

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 80
Vulnerability Type: Excessive credential requirements and violation of least privilege
Risk Level: High

Vulnerable Code Snippet:

markdown
| Wallet not configured | "No wallet configured." | Set WALLET_TYPE + PRIVATE_KEY |

Technical Analysis

The skill directs users to configure WALLET_TYPE and PRIVATE_KEY when a wallet is unavailable. The declared functionality—discovering Uniswap positions, reading balances, and calculating portfolio performance—is read-only and can be performed using a public wallet address and public blockchain data.

A private key grants transaction-signing authority and is therefore substantially more privileged than the public address required for portfolio reporting. Placing such a credential in an agent's environment may expose it to the delegated portfolio-analyst, other tools or processes operating in that environment, diagnostic output, or insecure environment handling.

The repository does not contain evidence that the key is directly read or exfiltrated. Nevertheless, the documented configuration creates an unnecessary credential-exposure path and expands the consequences of a compromised or incorrectly implemented delegated component.

Attack Path

  1. A user invokes the portfolio-report skill without a configured wallet.
  2. The skill returns the documented error and instructs the user to configure WALLET_TYPE and PRIVATE_KEY.
  3. The user places a transaction-signing private key in the agent or process environment.
  4. The delegated portfolio-analyst, another component sharing the environment, or a subsequently compromised dependency obtains access to the credential.
  5. The exposed private key can be used outside the reporting workflow to sign transactions for the associated account.

Impact Assessment

Successful access to the private key would provide transaction-signing authority over ...[truncated 526 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction to configure PRIVATE_KEY for portfolio reporting.
  2. Accept only a public wallet address for all read-only balance, position, fee, PnL, and impermanent-loss calculations.
  3. Replace the suggested action with wording such as: Provide a public wallet address or configure a read-only wallet address.
  4. If an authenticated RPC service is required, use a narrowly scoped provider API credential rather than a wallet-signing key.
  5. Explicitly prohibit private keys, seed phrases, and signing credentials in the skill documentation and delegated-agent parameters.
  6. Ensure the delegated agent receives only the public address and necessary chain filters.
  7. Add input validation that rejects values resembling private keys or seed phrases to reduce accidental disclosure.

T08 · Insecure Dependencies

Warning
Location
README.md:9
Finding

Unpinned Third-Party Installation Commands Use Mutable Sources

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 9-19
Vulnerability Type: Mutable and unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

markdown
Install into Claude Code or Cursor with:

```bash
npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/portfolio-report

Or via Clawhub:

bash
npx clawhub@latest install portfolio-report
text

### Technical Analysis

The documented installation procedures invoke third-party packages through `npx` and obtain skill content from mutable sources. The first command references the `main` branch of a GitHub repository rather than a reviewed commit. The second explicitly requests `clawhub@latest`, whose resolved package version can change over time.

As a result, the code executed or installed when a user follows these instructions is not necessarily the same code that was reviewed during this audit. Neither command provides a fixed version, commit identifier, checksum, signature, or other integrity constraint.

This creates a supply-chain risk: compromise of the package registry account, GitHub repository, mutable branch, installer package, or upstream release process could cause future installations to retrieve modified content. The reviewed project does not establish that either upstream source is currently malicious; the vulnerability is the lack of reproducibility and integrity pinning.

### Attack Path

1. An attacker compromises an upstream package account, repository, maintainer account, or release process.
2. The attacker publishes a malicious `latest` package version or changes content on the referenced `main` branch.
3. A user follows the installation command from the README.
4. `npx` retrieves the current mutable package, and the installer retrieves or installs the altered skill content.
5. Any malicious installer behavior executes with the invoking user's privileg
...[truncated 611 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace clawhub@latest with a specific reviewed package version.
  2. Pin the GitHub installation source to an immutable commit SHA instead of the main branch.
  3. Publish and verify cryptographic checksums or signed release artifacts before installation.
  4. Use lockfiles or equivalent dependency-resolution records where supported.
  5. Document the exact reviewed package version and repository commit.
  6. Avoid running installers with administrative privileges and recommend installation from a restricted environment.
  7. Establish a controlled update process in which new versions are reviewed before documentation pins are changed.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The README instructs users to execute npx skills add without pinning a specific package version. This causes the latest published package to be fetched and run at install time, which creates a supply-chain risk if the package is later compromised, replaced, or publishes a malicious update. Because this is an installation command in documentation, users may copy-paste it directly, increasing exploitability.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The README also recommends npx clawhub@latest install portfolio-report, which explicitly tracks the latest version rather than an immutable release. Running npx executes code retrieved from the registry, so a compromised maintainer account, malicious dependency update, or typo/squatting scenario could lead to arbitrary code execution on the user's machine. The skill context does not reduce this risk because the dangerous action happens during installation, before any portfolio-report functionality is used.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The description says to use the skill when the user asks about their positions, earnings, or portfolio overview, which is a broad natural-language condition rather than a tightly scoped trigger. This can cause unintended activation for general portfolio-related conversation, especially because the phrase does not clearly limit itself to Uniswap LP positions or provide exclusion cases.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: portfolio-report
description: Generate a comprehensive portfolio report for a wallet's Uniswap positions across all chains — covering total value, PnL, fee earnings, impermanent loss, and composition. Use when the user asks about their positions, earnings, or portfolio overview.
model: opus
allowed-tools: [Task(subagent_type:portfolio-analyst)]
---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

Several listed triggers, such as "Show me my positions" and "What's my portfolio worth?", are common requests that may refer to a user's broader wallet or investment portfolio rather than Uniswap LP positions. Without negative examples or explicit scoping, the activation boundary remains ambiguous.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.