ClawHub
Back to skill

Security audit

Uniswap Research And Trade

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly described research-and-trade workflow, but users should remember it can culminate in real wallet transactions after confirmation.

Install only from a source and version you trust, ideally a pinned commit or package version. Before using it, understand that an approved run can lead to a real Uniswap trade from a configured wallet after confirmation, with gas costs and irreversible on-chain settlement.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:9
Finding

Unpinned Third-Party Installation Commands Create a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 9-15
Vulnerability Type: Unpinned and mutable third-party installation sources
Risk Level: Medium

Vulnerable Code

bash
npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/research-and-trade
bash
npx clawhub@latest install research-and-trade

Technical Analysis

The documented installation commands rely on mutable third-party sources without pinning them to reviewed versions or verifying their integrity.

The first command installs skill content from the mutable main branch of a GitHub repository. The second uses the mutable latest package tag and allows npx to retrieve and execute a package version that may differ from the version reviewed during this audit.

Because neither command specifies an immutable Git commit, fixed package version, checksum, or trusted signature, future users may receive code that is different from the audited two-file artifact. This creates a time-of-review versus time-of-installation gap.

This finding concerns the documented installation process. The audited artifact itself contains no local executable scripts or confirmed malicious payload.

Attack Path

  1. An attacker compromises the upstream GitHub repository, package registry account, maintainer account, or another relevant publishing channel.
  2. The attacker modifies the repository’s main branch or publishes a malicious package version resolved by the latest tag.
  3. A user follows the installation instructions in README.md.
  4. npx retrieves mutable remote package content, and the installer retrieves or installs skill content that was not part of this audit.
  5. The malicious upstream content executes or is installed with the permissions of the user running the command.
  6. Depending on those permissions and the payload, the attacker may access user files, credentials, wallet-related data, or agent configuration.

Impact Assessment

Successf ...[truncated 485 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every npx package to a reviewed, immutable version instead of using @latest.
  2. Replace the GitHub main branch reference with a full reviewed commit SHA or immutable signed release tag.
  3. Publish cryptographic checksums for downloaded artifacts and verify them before installation.
  4. Use signed releases or package provenance mechanisms and document signature verification.
  5. Prefer lockfiles and reproducible installation procedures where applicable.
  6. Avoid executing package installers directly from mutable remote sources. Download and inspect the pinned artifact before execution when practical.
  7. Apply least privilege during installation: do not run the commands as root or with unnecessary access to secrets, wallets, or sensitive directories.
  8. Establish a dependency update process in which new versions are reviewed and approved before documentation is updated.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README promotes automatic trade execution based on the skill's internal risk assessment but does not clearly warn that this can move real funds and trigger irreversible on-chain transactions. In the context of a research-to-trade skill, that omission is especially dangerous because users may treat the action as informational or reversible when it can immediately spend assets.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The README instructs users to run an unpinned package via npx, which fetches the latest published version at execution time. If the package publisher account is compromised, the package is typosquatted, or a malicious update is published, users could execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The Clawhub install command uses npx with an unpinned package version, so users will execute whatever the latest published package contains. That creates a supply-chain risk where a compromised maintainer, registry account, or malicious release could run arbitrary code on the user's machine.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md
trades if the risk assessment approves. Stops and reports if risk is too high.
  Use when user wants "research X and buy if it looks good" or "due diligence
  then trade."
model: opus
allowed-tools:
  - Task(subagent_type:token-analyst)
  - Task(subagent_type:pool-researcher)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This skill can culminate in a real on-chain trade using the user's wallet, but the top-level description emphasizes research and conditional safety without clearly warning that approved execution spends live funds. In a trading context, that omission can mislead users about the consequence of invoking the skill and increases the chance of unintended financial transactions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.