Security checks for vulnerabilities and agentic risk
Overview
This skill is not malicious, but it asks agents to handle real token swaps while overclaiming recurring automation and persistence that its declared tools do not clearly support.
Review this before installing in any wallet-enabled environment. Use pinned, reviewed install sources; verify the skill version; and do not rely on it to create recurring automation unless you can independently confirm the local config file or Gelato task was actually created, funded, and cancellable. Treat any approval or first swap as real financial activity with possible future spending implications.
install setup-dca
npx skills@ add
```
2. Reference the Skill source using an immutable Git commit rather than the mutable `main` branch:
```text
https://github.com/wpank/Agentic-Uniswap/tree//.ai/skills/setup-dca
```
3. Publish expected cryptographic checksums or signed release artifacts and verify them before installation.
4. Use package-lock integrity metadata, provenance attestations, and npm signature or provenance verification where supported.
5. Advise users to download and inspect the package and Skill content before executing installation tooling, particularly in environments containing wallet credentials.
6. Run installation in a restricted environment with no wallet access, minimal filesystem permissions, and no unnecessary secrets in environment variables.
7. Establish a release process that reviews and signs each published Skill version, and document the exact audited version in the README.
]]>
The README instructs users to run npx skills add ... without pinning an exact package version, which means the code fetched and executed can change over time. Because npx may download and run the latest published package, a compromised or malicious upstream release could execute arbitrary code on the user's machine during installation.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding
The command npx clawhub@latest install setup-dca explicitly requests the latest version, creating a moving trust target. If the package publisher account is compromised or a harmful update is released, users following the README could execute attacker-controlled code as part of the install flow.
Content
No source excerpt is available for this finding.
External Model or Provider Selection
Medium
Category
Excessive Agency
Confidence
90% confidence
Finding
Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content
Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.
md
schedule, or build a DCA bot. Covers USDC approval, swap path selection,
frequency configuration, Gelato keeper automation, and monitoring. Works on
local testnet for development or mainnet for production.
model: opus
allowed-tools:
- Task(subagent_type:trade-executor)
- mcp__uniswap__execute_swap
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
The skill advertises capabilities to persist DCA state and set up Gelato automation, but its declared tools only support quoting, balances, safety checks, and swap execution. This mismatch can cause the agent or user to believe recurring automation and durable configuration exist when they do not, creating a dangerous gap between promised controls and actual execution behavior for financial operations.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The skill instructs that self-execute mode writes a local .uniswap/dca-config.json file, but no tool or mechanism exists to perform file writes. In a trading workflow, this can leave users believing a recurring strategy has been safely recorded when no durable state exists, leading to missed executions, unintended repeats, or unsafe manual recovery.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The skill claims it can create and fund Gelato automation tasks, yet the allowed toolset has no Gelato integration or generic contract-management capability. In this context, users may authorize an initial swap expecting future autonomous execution, but no keeper may actually be created, or the agent may attempt unsupported actions around on-chain automation, creating significant financial and operational risk.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding
The skill describes recurring agent-triggered or on-chain swaps, but it does not provide a strong, separate warning that approval and setup may lead to future executions beyond the initial trade. In a financial skill, this is especially dangerous because users may treat the first confirmation as a one-time action while the workflow is designed to continue spending funds on a schedule.
