Security audit

Uniswap Setup Agent Wallet

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its wallet-setup purpose, but it delegates real wallet creation and funding to an external subagent without clear pre-action confirmation or auditable local controls.

Review before installing. Only use this with a trusted, separately reviewed wallet-provisioner agent, pinned install sources, least-privilege provider credentials, and a low-balance funding wallet. Require an explicit confirmation step before any wallet creation or gas/token funding, especially if defaults like all chains or $1000/day are inferred.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: README.md:8
Finding: Unpinned Executable Installation Dependencies
Content: View full analysis
Remediation: View remediation
`. 2. Pin the GitHub installation source to an immutable commit hash rather than the `main` branch. 3. Where supported, verify package integrity using checksums, lockfiles, provenance attestations, or cryptographic signatures. 4. Document the expected package publisher and repository owner so users can verify the source before installation. 5. Review new dependency versions before updating the pinned references. 6. Run installation commands in a restricted environment without unnecessary credentials or administrative permissions. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:45
Finding: Privileged Wallet Operations Delegated Without Auditable Local Controls
Content: View full analysis
chains: environment: spendingLimit: ``` The agent internally handles all provisioning steps and returns the final wallet configuration. ``` The Skill metadata also authorizes this external task at `SKILL.md:5`: ```yaml allowed-tools: [Task(subagent_type:wallet-provisioner)] ``` ### Technical Analysis The Skill delegates provider API access, wallet creation, policy configuration, and transfers of gas tokens to a `wallet-provisioner` subagent. That subagent's implementation is not included in the audited project, which contains only `README.md` and `SKILL.md`. The visible workflow does not specify a mandatory confirmation boundary before funds are transferred. It also does not define controls for verifying the destination address, source wallet, chain, transfer amount, provider crede ...[truncated 1631 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (6)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The README instructs users to run npx skills add without pinning a specific package version or immutable source reference. That allows whatever package/version is current at execution time to run on the user's machine, creating a supply-chain risk that is especially dangerous here because the skill provisions wallets and may handle secrets, addresses, or funding steps.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The command npx clawhub@latest install setup-agent-wallet uses the mutable latest tag, which can change over time and cause users to execute unexpected code. In the context of a wallet-setup skill for Uniswap agents, compromise of the installer could lead to theft of funds, exfiltration of keys or configuration, or silent weakening of wallet security controls.
Content: No source excerpt is available for this finding.

External Model or Provider Selection

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: setup-agent-wallet description: Set up an agent wallet for Uniswap operations. Use when user needs to provision a wallet for an autonomous agent. Supports Privy (development), Turnkey (production), and Safe (maximum security). Configures spending limits, token allowlists, and funds the wallet for gas. model: opus allowed-tools: [Task(subagent_type:wallet-provisioner)] ---

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description does not clearly warn that setup includes sending gas funds and creating a local configuration file, so users may not realize the skill performs asset-moving and state-changing actions. In this context, omission increases risk of surprise transactions, unintended funding, and disclosure of wallet artifacts on disk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are generic enough to match ordinary wallet setup requests, which can cause the skill to activate outside the intended 'autonomous agent wallet' context. In this skill, unintended activation is more dangerous because execution can provision wallets, fund them with gas, and write configuration files, creating real financial and operational side effects from ambiguous user intent.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
md
Extract these from the user's request: | Parameter | Required | Default | Description | | --------------- | -------- | ------------- | -------------------------------------------------------------------------------------------- | | `provider` | No | `privy` | Wallet provider: `privy` (development), `turnkey` (production), or `safe` (maximum security) | | `chains` | No | `all` | Chains to configure — chain names or "all" for all supported chains |

Static analysis

No suspicious patterns detected.