ClawHub
Back to skill

Security audit

Uniswap Self Funding Setup

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent about setting up crypto-based agent funding, but it gives agents broad financial authority with weak transaction-by-transaction user control.

Install only from a pinned, verified version. Before using this skill, require explicit approval for every wallet funding, token deployment, liquidity lock, approval, treasury automation, and mainnet registration transaction, and lower the spending limit to a task-specific amount.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
README.md:10
Finding

Unpinned Third-Party Installation Commands Permit Supply-Chain Code Substitution

Content
View full analysis
Remediation
View remediation
/.ai/skills/self-funding-setup ``` 3. Document SHA-256 checksums or signed release provenance for downloaded artifacts. 4. Avoid executing packages directly from the network where practical. Download the package, verify its integrity and signature, inspect its contents, and then install it. 5. Use npm lockfiles and integrity metadata for any maintained dependency set. 6. Enable registry account protections, including multi-factor authentication, provenance attestations, and restricted publication tokens. 7. Add automated monitoring for ownership changes, unexpected releases, and modifications to referenced repository content. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:133
Finding

Irreversible Financial Operations Lack an Enforced User Confirmation and Simulation Gate

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The README instructs users to run npx skills add ... without pinning an exact package version, which means the package resolved at execution time could change or be replaced with a malicious release. Because npx fetches and executes code, this creates a supply-chain execution risk for anyone following the installation instructions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The command npx clawhub@latest install self-funding-setup explicitly tracks the latest version, causing users to execute whatever code is most recently published. In a security-sensitive skill that configures wallets, tokens, treasury, identity, and payments, executing an unpinned installer increases supply-chain compromise risk and could lead to credential theft or malicious setup actions.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
registers identity on ERC-8004, and sets up x402 micropayments. Use when
  user wants to make their agent self-funding, earn and manage its own
  revenue, or configure autonomous agent operations end-to-end.
model: opus
allowed-tools:
  - Task(subagent_type:wallet-provisioner)
  - Task(subagent_type:token-deployer)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill orchestrates real wallet provisioning, funding, token deployment, and Ethereum mainnet identity registration, but it does not require an explicit user confirmation or prominent warning immediately before irreversible or value-spending steps. In a composite workflow like this, users may trigger multiple on-chain actions and incur real costs without clearly understanding that funds will be moved and irreversible transactions will occur.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs direct creation of repository files such as .uniswap/x402-config.json and .well-known/x402-manifest.json without clearly warning the user that local project files will be modified. While lower risk than on-chain spending, silent writes can alter deployment behavior, expose payment endpoints, or commit unintended configuration into source control.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.