T08 · Insecure Dependencies
Warning
- Location
README.md:12- Finding
Unpinned Third-Party Installation Commands Create Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Uniswap Seek Protocol Fees
Security checks for vulnerabilities and agentic risk
Overview
The skill is openly about Uniswap fee analysis and execution, but its instructions allow an irreversible 4,000 UNI burn to proceed from inferred wording without a fresh transaction-specific confirmation.
Review carefully before installing. Use this only with a wallet and transaction policy that require human approval for every burn and swap, avoid broad prompts like "claim fees," and prefer pinned installation sources. Do not allow auto-execution for the 4,000 UNI burn or post-burn swaps without confirming the exact chain, contract, amount, recipient, assets, gas limit, and expected proceeds.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:207- Finding
Irreversible UNI Burn Can Proceed Without Transaction-Specific Confirmation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Scope Creep
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documented workflow requires execution, simulation, pricing, gas estimation, and optional swap capabilities that are not declared in allowed-tools. Undeclared capabilities are dangerous because they encourage hidden delegation or policy bypass through subagents, making it difficult for enforcement layers to reason about what the skill can actually do.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The README instructs users to run
npx skills addwithout pinning a specific package version or immutable source revision. That allows whatever package/version is current at install time to be fetched and executed, creating supply-chain risk if the package is updated maliciously, compromised, or replaced. In the context of a skill that can analyze assets and potentially execute on-chain burn-and-claim actions, installation-time compromise is more dangerous because users are likely to grant the tool access to sensitive environments or wallets.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The README also recommends
npx clawhub@latest install seek-protocol-fees, and using@latestis effectively unpinned execution of remote code. If the upstream package or distribution channel is compromised, users may execute attacker-controlled code during installation. Because this skill is related to profitability analysis and optional transaction execution, a compromised installer could target credentials, wallet configuration, or manipulate financial actions, making the supply-chain exposure more consequential.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrase "Claim protocol fees" is broad enough to match unrelated fee-claiming intents beyond this specific TokenJar/Firepit flow. Over-broad routing can invoke a destructive financial skill in the wrong context, increasing the chance of accidental analysis of the wrong assets or escalation toward an irreversible burn workflow.
- Content
External Model or Provider Selection
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
- Content
md 4,000 UNI burn cost, simulates, and executes if profitable. Default is preview-only. Use when user asks "Is the TokenJar profitable?", "Execute a burn", or "Claim protocol fees." model: opus allowed-tools: - Task(subagent_type:protocol-fee-seeker) - Task(subagent_type:safety-guardian)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 92% confidence
- Finding
The skill is designed as an autonomous pipeline that evaluates profitability and can proceed to destructive financial execution based on inferred parameters. Even with preview as the default, the documented design normalizes decision-making and action sequencing around burning 4,000 UNI, so misclassification of user intent or parameter extraction could lead to unauthorized value destruction.
- Content
md **Why this is 10x better than calling tools individually:** 1. **9-step workflow compressed to one command**: Without this skill, a user must manually check TokenJar balances, price each token in USD, check the Firepit threshold, calculate UNI burn cost at current prices, estimate gas, determine net profitability, select optimal assets, simulate the burn, and finally execute. This skill does all of it with compound context flowing between each step. 2. **Safety-gated execution**: Default mode is preview-only (`auto-execute: false`). Even when execution is enabled, the pipeline simulates first, validates through `safety-guardian`, and checks nonce freshness for race conditions -- protections that are easy to skip when calling tools manually. 3. **Profitability dashboard**: The output is a structured profitability report, not raw JSON from 6 different tools. You see gross value, burn cost, gas cost, net profit, ROI, and per-asset breakdown in one view. 4. **Post-burn conversion**: Optionally converts received tokens to stablecoins in the same pipeline, calculating the true net profit after conversion slippage.
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill manifest and top-level description scope the skill to analysis plus optional burn-and-claim, but the body also introduces post-burn swaps into stablecoins. This creates a capability mismatch where reviewers, routers, or policy layers may approve a narrower, less risky skill while the actual instructions authorize additional value-moving behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The activation guidance includes broad phrases like "Seek protocol fees" and similar examples with limited constraints, which increases the chance this skill is selected for vague or unrelated user requests. Because this skill can culminate in irreversible on-chain actions, loose activation criteria materially raise misuse risk.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 95% confidence
- Finding
The parameter extraction rule states that phrases like "execute the burn" or "claim fees" imply auto-execute=true, allowing destructive behavior to be inferred from natural-language intent instead of requiring explicit transactional consent. In a financial context involving irreversible UNI burning, inference-based execution materially increases the risk of accidental or manipulated authorization.
- Content
md | Parameter | Required | Default | How to Extract | | -------------- | -------- | ---------------- | --------------------------------------------------------------------- | | chain | No | ethereum | Always Ethereum mainnet for TokenJar/Firepit | | auto-execute | No | false | "execute the burn", "claim fees" implies true; "check", "preview" implies false | | post-burn-swap | No | false | "convert to stables", "swap to USDC" implies true | | recipient | No | connected wallet | Explicit address if provided, otherwise agent's wallet |
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 93% confidence
- Finding
The workflow states that if auto-execute is true, the skill presents a report and proceeds, which weakens the safety boundary between analysis and irreversible execution. This is especially dangerous because the same skill can move from informational use to burning 4,000 UNI without a hard stop for interactive confirmation.
- Content
md │ ▼ │ │ │ │ Step 3: USER CONFIRMATION │ │ ├── If auto-execute: false → present report, ask user │ │ ├── If auto-execute: true → present report, proceed │ │ └── User must explicitly confirm before UNI is burned │ │ │ │
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The workflow contains contradictory guidance: it says the user must explicitly confirm before UNI is burned, while also stating that auto-execute=true proceeds without waiting. This inconsistency is dangerous because implementers may follow the less safe branch, leading to execution behavior that bypasses the intended consent requirement.
- Content
md │ │ │ Step 3: USER CONFIRMATION │ │ ├── If auto-execute: false → present report, ask user │ │ ├── If auto-execute: true → present report, proceed │ │ └── User must explicitly confirm before UNI is burned │ │ │ │ │ ▼ │
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
Step 3: User Confirmation
If the burn is profitable and
auto-executeisfalse(default), present the full profitability report and ask for explicit confirmation:text Burn Confirmation Required
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 96% confidence
- Finding
This line explicitly permits proceeding to execution without waiting if auto-execute is true, despite the action being irreversible and costly. In the context of burning 4,000 UNI, bypassing a live confirmation creates a direct path to unauthorized or mistaken asset destruction.
- Content
This will permanently burn 4,000 UNI. Proceed? (yes/no)
text **Only proceed to Step 4 if the user explicitly confirms.** If `auto-execute` is `true`, still present the report but proceed without waiting. ### Step 4: Simulate + Execute (protocol-fee-seeker)
Static analysis
No suspicious patterns detected.