ClawHub
Back to skill

Security audit

Setup Local Anvil Testnet

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its local Uniswap testnet purpose, but its setup guidance relies on mutable remote installers and unpinned install commands that deserve review before use.

Install only if you are comfortable with the setup supply-chain risk. Prefer pinned package versions and immutable repository references, and install Foundry using a method you can review or verify instead of piping a remote script directly into a shell. Treat the provided Anvil private keys as local test keys only and never use them with real funds.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:65
Finding

Unverified Remote Foundry Installer Is Piped Directly into a Shell

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
README.md:8
Finding

Installation Instructions Execute Unpinned Third-Party Packages and Mutable Repository Content

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill instructs users to install Foundry by piping a remote script directly into bash, which is a classic unsafe supply-chain pattern. If the remote server, transport, or published installer is compromised, arbitrary code will execute immediately on the user's machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

  1. Anvil availability: The tool will return a clear error if Anvil is not installed. If you see TESTNET_ANVIL_NOT_FOUND, tell the user:

    text
    Anvil (Foundry) is required but not installed.
Install: curl -L https://foundry.paradigm.xyz | bash && foundryup

  2. Network access: Fork mode requires network access to the chain's RPC. If you see TESTNET_STARTUP_TIMEOUT, suggest checking network connectivity or trying a different chain.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

  • Test time-dependent logic: "Advance time by 7 days"
    • Test a swap: "Get a quote for 1 WETH → USDC on the local testnet"
    • Fund more tokens: "Fund account #1 with 10,000 WBTC"
    • Configure your MCP server: Set RPC_URL_1=http://127.0.0.1:8545 in .env
text

## Important Notes

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

This repeats the same unsafe external-script execution pattern in the error-handling table, reinforcing insecure behavior as a recommended remediation. Repetition increases the chance users will copy and execute unverified remote code without scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md
| Error                          | User-Facing Message                                                      | Suggested Action                                                |
| ------------------------------ | ------------------------------------------------------------------------ | --------------------------------------------------------------- |
| `TESTNET_ANVIL_NOT_FOUND`      | "Anvil (Foundry) is not installed."                                      | Install: `curl -L https://foundry.paradigm.xyz \| bash && foundryup` |
| `TESTNET_STARTUP_TIMEOUT`      | "Anvil did not start within 30s. Fork RPC may be unreachable."           | Check network, try a different chain, or retry                  |
| `TESTNET_INVALID_FORK_CHAIN`   | "Chain X is not supported for forking."                                  | Use ethereum, base, arbitrum, optimism, or polygon              |
| `TESTNET_MOCK_NOT_IMPLEMENTED` | "Mock mode is not yet implemented."                                      | Use fork mode instead                                           |

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The README instructs users to execute an unpinned package via npx skills, which fetches and runs the latest published version at install time. If that package or one of its dependencies is compromised, users could execute attacker-controlled code simply by following the documented setup steps.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The command npx clawhub@latest install setup-local-testnet explicitly tracks the latest release, causing arbitrary newly published code to be executed on user machines. This creates a supply-chain risk where a compromised publisher account, malicious release, or dependency hijack can lead to code execution during installation.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
One command gives you a full development environment with funded accounts,
  real Uniswap pools, and zero gas costs. Use when developing, testing, or
  demoing Uniswap agent workflows.
model: sonnet
allowed-tools:
  - mcp__uniswap__setup_local_testnet
  - mcp__uniswap__fund_test_account

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The invocation guidance includes broad phrases such as "Set up a dev environment" and "Create a test environment for my agent," which are not specific to Uniswap or local Anvil testnets. These phrases could cause unintended activation for unrelated development or testing tasks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.