Uniswap Rebalance Position

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:48 PM UTC
• Version: 0.1.0

Overview

This skill performs the financial rebalance it advertises and requires confirmation, but users should treat the install commands and on-chain actions carefully.

Before installing, prefer a pinned release or verified commit instead of mutable latest/main commands. Before using the skill, review the proposed chain, pool, position ID, range, gas, slippage, and token approvals, and only confirm if you accept that closing and reopening an LP position is irreversible and may realize losses or tax consequences.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:9

Finding

Unpinned Installation Tools and Mutable Remote Skill Source

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 9–15
Vulnerability Type: Supply-chain exposure through unpinned installation tools and mutable remote content
Risk Level: Medium

Vulnerable Code

bash

npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/rebalance-position

bash

npx clawhub@latest install rebalance-position

Technical Analysis

The documented installation commands execute npm-resolved command-line tools without pinning them to audited package versions or integrity hashes. The first command also installs Skill content from the mutable main branch of a remote GitHub repository. The second command explicitly selects the mutable latest version of the Clawhub installer.

Consequently, the code executed or installed when a user follows these instructions can differ from the files reviewed during this audit. This creates a time-of-check/time-of-use supply-chain boundary: compromise of an npm publisher account, the GitHub repository, its maintainers, the branch, or the relevant distribution infrastructure could substitute malicious installer code or Skill content.

No malicious dependency or current compromise was established. The vulnerability is the unsafe installation pattern and its exposure to future upstream changes.

Attack Path

1. An attacker compromises an applicable npm publisher account, GitHub maintainer account, repository, release process, or distribution channel.
2. The attacker publishes a malicious package version or modifies the Skill content referenced by the mutable main branch.
3. A user follows one of the documented npx installation commands.
4. npx resolves and executes the altered tool, or the installer retrieves altered Skill content.
5. The malicious installer or installed Skill executes under the installing user's account.

Impact Assessment

Successful exploitation could allow arbitrary code execut ...[truncated 535 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each npm command-line tool to an exact reviewed version rather than relying on implicit resolution or @latest.
2. Replace the mutable GitHub main branch URL with a reviewed commit SHA or immutable signed release tag.
3. Publish and verify cryptographic checksums or signatures for the installer and Skill package.
4. Use lockfiles and npm integrity metadata where applicable.
5. Document the expected package version, repository commit, and checksum so users can verify provenance before installation.
6. Recommend installation in a least-privileged or sandboxed environment and caution users against running installers with administrative privileges.
7. Establish release signing, protected branches, mandatory review, and multi-factor authentication for package and repository maintainers.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README promotes closing and reopening LP positions but does not prominently warn that these are irreversible on-chain transactions that can incur gas costs, slippage, tax consequences, and temporary or permanent value loss if executed incorrectly. In a DeFi skill, omission of this warning is more dangerous because users may treat the workflow as routine automation and approve transactions without understanding the financial risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx skills add ... without pinning the package version, which means the fetched package may change over time and could execute newly introduced malicious or compromised code at install time. In a wallet/DeFi skill context, that is more dangerous because users are likely to run the command on systems that also hold credentials, API keys, or access to signing workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The npx clawhub@latest install rebalance-position command explicitly tracks latest, which is mutable and can pull different code in the future, including a compromised release. Because this skill concerns Uniswap position management and likely operates near high-value wallet activity, executing an unpinned installer increases supply-chain risk materially.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: rebalance-position
description: Rebalance an out-of-range Uniswap V3/V4 LP position by closing the old position and opening a new one centered on the current price. Handles fee collection, removal, range calculation, and re-entry in a single workflow. Use when a position is out of range and needs adjustment.
model: opus
allowed-tools: [Task(subagent_type:liquidity-manager), mcp__uniswap__get_positions_by_owner, mcp__uniswap__get_position, mcp__uniswap__get_pool_info]
---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs the agent to proactively suggest rebalancing based on other workflows such as performance tracking or portfolio reporting, which broadens activation beyond direct user intent. In a high-risk financial skill that can close positions and reopen them, this increases the chance of unintended or socially-steered invocation and can push users toward irreversible actions they did not clearly request.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.