Uniswap Seek Protocol Fees

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:48 PM UTC
• Version: 0.1.0

Overview

The skill is openly about Uniswap fee analysis and execution, but its instructions allow an irreversible 4,000 UNI burn to proceed from inferred wording without a fresh transaction-specific confirmation.

Review carefully before installing. Use this only with a wallet and transaction policy that require human approval for every burn and swap, avoid broad prompts like "claim fees," and prefer pinned installation sources. Do not allow auto-execution for the 4,000 UNI burn or post-burn swaps without confirming the exact chain, contract, amount, recipient, assets, gas limit, and expected proceeds.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:12
• Finding: Unpinned Third-Party Installation Commands Create Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `README.md:12-18` **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```markdown npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/seek-protocol-fees ``` Or via Clawhub: ```bash npx clawhub@latest install seek-protocol-fees ``` ### Technical Analysis The documented installation procedures depend on mutable third-party sources: - `npx skills add` does not pin the `skills` package to a reviewed version and installs skill content from a mutable branch path. - The GitHub URL points to `main` rather than an immutable commit hash or signed release. - `npx clawhub@latest` explicitly requests whichever Clawhub release is current at installation time. - The installed `seek-protocol-fees` package is not pinned to a specific version or integrity digest. Consequently, the effective installer and installed skill may differ from the artifact reviewed in this audit. If the npm package, Clawhub package, GitHub account, repository, or publishing credentials are compromised, attackers could replace the expected content with malicious instructions or code. ### Attack Path 1. An attacker compromises an upstream package, publishing account, repository, or mutable branch referenced by the installation commands. 2. The attacker publishes a malicious version of the installer or modifies the remote skill content. 3. A user follows the documented `npx` installation command. 4. `npx` resolves and runs the current, unpinned package, or the installer downloads the modified skill from the mutable source. 5. The malicious installer or skill runs with the permissions of the user performing the installation. 6. Depending on those permissions and the substituted payload, the attacker could modify files accessible to that user, install malicious skill instructions, access environment data exposed to the process, or cause later agent sessions to ...[truncated 711 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every npm utility to an exact reviewed version, for example: ```bash npx --yes skills@X.Y.Z add ... npx --yes clawhub@X.Y.Z install seek-protocol-fees@A.B.C ``` 2. Replace the mutable GitHub `main` URL with an immutable commit reference. 3. Publish and verify cryptographic checksums or signatures for the skill artifact. 4. Use lockfiles and npm integrity metadata where applicable. 5. Prefer a trusted registry release with provenance attestations over installation directly from a mutable repository branch. 6. Document the exact package versions, commit hash, and artifact digest covered by the security review. 7. Run installation in a restricted environment without wallet secrets or unrelated credentials. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:207
• Finding: Irreversible UNI Burn Can Proceed Without Transaction-Specific Confirmation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:207-222` **Vulnerability Type**: Unsafe authorization flow for an irreversible financial transaction **Risk Level**: High ### Vulnerable Code ```markdown ### Step 3: User Confirmation If the burn is profitable and `auto-execute` is `false` (default), present the full profitability report and ask for explicit confirmation: ```text Burn Confirmation Required TokenJar Value: $52,000 (5 assets) Burn Cost: $28,045 (4,000 UNI + $45 gas) Net Profit: $23,955 (85.4% ROI) Assets to Claim: WETH, USDC, USDT, WBTC, DAI Post-Burn Swap: {Yes — convert to USDC | No — keep as received} This will permanently burn 4,000 UNI. Proceed? (yes/no) ``` **Only proceed to Step 4 if the user explicitly confirms.** If `auto-execute` is `true`, still present the report but proceed without waiting. ``` The automatic-execution flag is inferred broadly at `SKILL.md:53`: ```markdown | auto-execute | No | false | "execute the burn", "claim fees" implies true; "check", "preview" implies false | ``` ### Technical Analysis The workflow contains conflicting authorization requirements. It states that the user must explicitly confirm before UNI is burned, but it also directs the agent to proceed without waiting whenever `auto-execute` is inferred as true. The phrase `"claim fees"` is sufficient to enable automatic execution. This request does not necessarily establish informed authorization for the exact transaction generated later, including: - The current 4,000 UNI burn amount and its market value. - Gas costs at execution time. - Selected assets. - Recipient address. - Profitability assumptions and price freshness. - Optional post-burn conversions. Simulation, safety-agent validation, and nonce checking address transaction correctness and race conditions, but they do not establish user authorization. The workflow can therefore broadcast an irreversible transaction based on gen ...[truncated 1564 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require a fresh, explicit confirmation after displaying the complete final transaction summary, regardless of the `auto-execute` setting. 2. Do not infer irreversible execution from broad phrases such as “claim fees.” 3. Require an unambiguous authorization phrase or structured parameter, such as: ```text Confirm burn of exactly 4,000 UNI, maximum gas $X, recipient 0x..., assets [...], nonce N. ``` 4. Bind the confirmation to immutable transaction parameters, including: - Chain ID. - Firepit contract address. - Burn quantity. - Selected assets. - Recipient. - Maximum gas cost. - Minimum expected net proceeds. - Nonce and expiration time. 5. Invalidate confirmation whenever balances, nonce, prices, recipient, selected assets, gas limits, or calldata change. 6. Enforce wallet-level spending limits and transaction policy checks independently of agent instructions. 7. Keep simulation and safety validation, but treat them as additional controls rather than substitutes for user authorization. 8. If unattended execution is a required feature, configure it separately through a narrowly scoped, persistent policy with explicit limits instead of deriving it from conversational wording. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Scope Creep

High

• Confidence: 99% confidence
• Finding: The documented workflow requires execution, simulation, pricing, gas estimation, and optional swap capabilities that are not declared in allowed-tools. Undeclared capabilities are dangerous because they encourage hidden delegation or policy bypass through subagents, making it difficult for enforcement layers to reason about what the skill can actually do.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The README instructs users to run `npx skills add` without pinning a specific package version or immutable source revision. That allows whatever package/version is current at install time to be fetched and executed, creating supply-chain risk if the package is updated maliciously, compromised, or replaced. In the context of a skill that can analyze assets and potentially execute on-chain burn-and-claim actions, installation-time compromise is more dangerous because users are likely to grant the tool access to sensitive environments or wallets.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README also recommends `npx clawhub@latest install seek-protocol-fees`, and using `@latest` is effectively unpinned execution of remote code. If the upstream package or distribution channel is compromised, users may execute attacker-controlled code during installation. Because this skill is related to profitability analysis and optional transaction execution, a compromised installer could target credentials, wallet configuration, or manipulate financial actions, making the supply-chain exposure more consequential.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrase "Claim protocol fees" is broad enough to match unrelated fee-claiming intents beyond this specific TokenJar/Firepit flow. Over-broad routing can invoke a destructive financial skill in the wrong context, increasing the chance of accidental analysis of the wrong assets or escalation toward an irreversible burn workflow.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

4,000 UNI burn cost, simulates, and executes if profitable. Default is
  preview-only. Use when user asks "Is the TokenJar profitable?", "Execute a
  burn", or "Claim protocol fees."
model: opus
allowed-tools:
  - Task(subagent_type:protocol-fee-seeker)
  - Task(subagent_type:safety-guardian)

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Why this is 10x better than calling tools individually:**

1. **9-step workflow compressed to one command**: Without this skill, a user must manually check TokenJar balances, price each token in USD, check the Firepit threshold, calculate UNI burn cost at current prices, estimate gas, determine net profitability, select optimal assets, simulate the burn, and finally execute. This skill does all of it with compound context flowing between each step.
2. **Safety-gated execution**: Default mode is preview-only (`auto-execute: false`). Even when execution is enabled, the pipeline simulates first, validates through `safety-guardian`, and checks nonce freshness for race conditions -- protections that are easy to skip when calling tools manually.
3. **Profitability dashboard**: The output is a structured profitability report, not raw JSON from 6 different tools. You see gross value, burn cost, gas cost, net profit, ROI, and per-asset breakdown in one view.
4. **Post-burn conversion**: Optionally converts received tokens to stablecoins in the same pipeline, calculating the true net profit after conversion slippage.

• Confidence: 92% confidence
• Finding: The skill is designed as an autonomous pipeline that evaluates profitability and can proceed to destructive financial execution based on inferred parameters. Even with preview as the default, the documented design normalizes decision-making and action sequencing around burning 4,000 UNI, so misclassification of user intent or parameter extraction could lead to unauthorized value destruction.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill manifest and top-level description scope the skill to analysis plus optional burn-and-claim, but the body also introduces post-burn swaps into stablecoins. This creates a capability mismatch where reviewers, routers, or policy layers may approve a narrower, less risky skill while the actual instructions authorize additional value-moving behavior.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The activation guidance includes broad phrases like "Seek protocol fees" and similar examples with limited constraints, which increases the chance this skill is selected for vague or unrelated user requests. Because this skill can culminate in irreversible on-chain actions, loose activation criteria materially raise misuse risk.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Parameter      | Required | Default          | How to Extract                                                        |
| -------------- | -------- | ---------------- | --------------------------------------------------------------------- |
| chain          | No       | ethereum         | Always Ethereum mainnet for TokenJar/Firepit                          |
| auto-execute   | No       | false            | "execute the burn", "claim fees" implies true; "check", "preview" implies false |
| post-burn-swap | No       | false            | "convert to stables", "swap to USDC" implies true                     |
| recipient      | No       | connected wallet | Explicit address if provided, otherwise agent's wallet                |

• Confidence: 95% confidence
• Finding: The parameter extraction rule states that phrases like "execute the burn" or "claim fees" imply auto-execute=true, allowing destructive behavior to be inferred from natural-language intent instead of requiring explicit transactional consent. In a financial context involving irreversible UNI burning, inference-based execution materially increases the risk of accidental or manipulated authorization.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

│          ▼                                                          │
  │                                                                     │
  │  Step 3: USER CONFIRMATION                                          │
  │  ├── If auto-execute: false → present report, ask user              │
  │  ├── If auto-execute: true → present report, proceed                │
  │  └── User must explicitly confirm before UNI is burned              │
  │          │                                                          │

• Confidence: 93% confidence
• Finding: The workflow states that if auto-execute is true, the skill presents a report and proceeds, which weakens the safety boundary between analysis and irreversible execution. This is especially dangerous because the same skill can move from informational use to burning 4,000 UNI without a hard stop for interactive confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

│                                                                     │
  │  Step 3: USER CONFIRMATION                                          │
  │  ├── If auto-execute: false → present report, ask user              │
  │  ├── If auto-execute: true → present report, proceed                │
  │  └── User must explicitly confirm before UNI is burned              │
  │          │                                                          │
  │          ▼                                                          │

• Confidence: 85% confidence
• Finding: The workflow contains contradictory guidance: it says the user must explicitly confirm before UNI is burned, while also stating that auto-execute=true proceeds without waiting. This inconsistency is dangerous because implementers may follow the less safe branch, leading to execution behavior that bypasses the intended consent requirement.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Step 3: User Confirmation

If the burn is profitable and `auto-execute` is `false` (default), present the full profitability report and ask for explicit confirmation:

```text
Burn Confirmation Required

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

This will permanently burn 4,000 UNI. Proceed? (yes/no)
```

**Only proceed to Step 4 if the user explicitly confirms.** If `auto-execute` is `true`, still present the report but proceed without waiting.

### Step 4: Simulate + Execute (protocol-fee-seeker)

• Confidence: 96% confidence
• Finding: This line explicitly permits proceeding to execution without waiting if auto-execute is true, despite the action being irreversible and costly. In the context of burning 4,000 UNI, bypassing a live confirmation creates a direct path to unauthorized or mistaken asset destruction.

Static analysis

No suspicious patterns detected.