Setup Local Anvil Testnet

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:49 PM UTC
• Version: 0.1.0

Overview

The skill matches its local Uniswap testnet purpose, but its setup guidance relies on mutable remote installers and unpinned install commands that deserve review before use.

Install only if you are comfortable with the setup supply-chain risk. Prefer pinned package versions and immutable repository references, and install Foundry using a method you can review or verify instead of piping a remote script directly into a shell. Treat the provided Anvil private keys as local test keys only and never use them with real funds.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:65
• Finding: Unverified Remote Foundry Installer Is Piped Directly into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 65 and 149 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Complete Code Snippets**: `SKILL.md:62-66` ```text 1. **Anvil availability**: The tool will return a clear error if Anvil is not installed. If you see `TESTNET_ANVIL_NOT_FOUND`, tell the user: ``` Anvil (Foundry) is required but not installed. Install: curl -L https://foundry.paradigm.xyz | bash && foundryup ``` ``` `SKILL.md:149` ```markdown | `TESTNET_ANVIL_NOT_FOUND` | "Anvil (Foundry) is not installed." | Install: `curl -L https://foundry.paradigm.xyz \| bash && foundryup` | ``` ### Technical Analysis The installation command downloads content from an external URL and immediately passes the response to `bash`. It does not pin an installer version, inspect the downloaded script, or verify a cryptographic checksum or signature. Installing Anvil is a legitimate prerequisite for the declared local-testnet functionality. However, direct execution of mutable remote content is not necessary and exceeds the minimum-risk installation approach. The behavior creates a time-of-check/time-of-use supply-chain boundary: the code executed by a future user may differ from the content available when this skill was audited. The apparent association of the domain with Foundry does not remove this risk. Compromise of the hosting endpoint, delivery infrastructure, DNS resolution, TLS trust path, or upstream publishing credentials could substitute arbitrary shell commands. ### Attack Path 1. A user invokes the skill on a system where Anvil is unavailable. 2. The skill returns or recommends the documented installation command. 3. The user runs `curl -L https://foundry.paradigm.xyz | bash && foundryup`. 4. `curl` follows redirects and retrieves the current response from the remote service. 5. The respo ...[truncated 1082 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all `curl | bash` installation instructions. 2. Direct users to Foundry's official installation documentation and require explicit review before executing any installer. 3. Prefer a version-pinned release artifact from the official release repository. 4. Download the artifact as a separate step and verify a publisher-provided cryptographic checksum or signature before execution. 5. Display the exact version, source URL, expected digest, and destination path. 6. Run the installer without `sudo` and with ordinary user privileges unless a specific operation demonstrably requires elevation. 7. Fail safely if integrity verification cannot be completed rather than falling back to executing mutable remote content. 8. Apply the corrected guidance consistently to both the prerequisite workflow and error-handling table. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:8
• Finding: Installation Instructions Execute Unpinned Third-Party Packages and Mutable Repository Content<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 8-17 **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: Medium **Complete Code Snippet**: ```markdown ## Installation Install into Claude Code or Cursor with: ```bash npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/setup-local-testnet ``` Or via Clawhub: ```bash npx clawhub@latest install setup-local-testnet ``` ``` ### Technical Analysis Both installation methods depend on mutable third-party content: - `npx skills add ...` does not pin the invoked `skills` package version and references content under the repository's mutable `main` branch. - `npx clawhub@latest ...` explicitly requests the latest published `clawhub` package rather than an audited version. Consequently, the commands can retrieve code different from the version represented by this audit. No package version lock, immutable commit identifier, integrity digest, or signature-verification process is supplied. Use of `npx` may download and execute package-provided command-line code. This creates a supply-chain execution boundary before the requested skill is installed. Referencing a mutable repository branch also allows later repository changes to alter the installed skill without changing these instructions. This finding does not establish that the named packages or repository are currently compromised. The vulnerability is the absence of controls that would prevent a future compromised or malicious release from being executed. ### Attack Path 1. An attacker compromises a relevant package-publishing account, package source, repository account, or upstream release process. 2. The attacker publishes a modified package under the selected mutable version or changes content on the referenced `main` branch. 3. A user follows one of the documented installation commands. 4. `npx` retrieves and executes the ...[truncated 1024 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the `skills` and `clawhub` command-line packages to specific audited versions instead of using an implicit version or `@latest`. 2. Replace the repository's `main` branch URL with an immutable commit hash or signed release tag. 3. Publish and verify integrity hashes or signatures for downloaded skill content. 4. Document the expected package publisher, repository owner, version, commit, and checksum so users can validate provenance. 5. Use a lockfile or equivalent integrity mechanism where the installation workflow supports one. 6. Avoid package lifecycle or installer execution where a reviewable, manually downloaded artifact is sufficient. 7. Require explicit user confirmation before executing newly downloaded package code. 8. Establish an update process in which newer versions are separately reviewed rather than automatically selected. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

External Script Fetching

High

• Category: Supply Chain

Content

1. **Anvil availability**: The tool will return a clear error if Anvil is not installed. If you see `TESTNET_ANVIL_NOT_FOUND`, tell the user:
   ```
   Anvil (Foundry) is required but not installed.
   Install: curl -L https://foundry.paradigm.xyz | bash && foundryup
   ```

2. **Network access**: Fork mode requires network access to the chain's RPC. If you see `TESTNET_STARTUP_TIMEOUT`, suggest checking network connectivity or trying a different chain.

• Confidence: 98% confidence
• Finding: The skill instructs users to install Foundry by piping a remote script directly into bash, which is a classic unsafe supply-chain pattern. If the remote server, transport, or published installer is compromised, arbitrary code will execute immediately on the user's machine with the user's privileges.

Credential Access

High

• Category: Privilege Escalation

Content

- Test time-dependent logic: "Advance time by 7 days"
  - Test a swap: "Get a quote for 1 WETH → USDC on the local testnet"
  - Fund more tokens: "Fund account #1 with 10,000 WBTC"
  - Configure your MCP server: Set RPC_URL_1=http://127.0.0.1:8545 in .env
```

## Important Notes

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Script Fetching

High

• Category: Supply Chain

Content

| Error                          | User-Facing Message                                                      | Suggested Action                                                |
| ------------------------------ | ------------------------------------------------------------------------ | --------------------------------------------------------------- |
| `TESTNET_ANVIL_NOT_FOUND`      | "Anvil (Foundry) is not installed."                                      | Install: `curl -L https://foundry.paradigm.xyz \| bash && foundryup` |
| `TESTNET_STARTUP_TIMEOUT`      | "Anvil did not start within 30s. Fork RPC may be unreachable."           | Check network, try a different chain, or retry                  |
| `TESTNET_INVALID_FORK_CHAIN`   | "Chain X is not supported for forking."                                  | Use ethereum, base, arbitrum, optimism, or polygon              |
| `TESTNET_MOCK_NOT_IMPLEMENTED` | "Mock mode is not yet implemented."                                      | Use fork mode instead                                           |

• Confidence: 98% confidence
• Finding: This repeats the same unsafe external-script execution pattern in the error-handling table, reinforcing insecure behavior as a recommended remediation. Repetition increases the chance users will copy and execute unverified remote code without scrutiny.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The README instructs users to execute an unpinned package via `npx skills`, which fetches and runs the latest published version at install time. If that package or one of its dependencies is compromised, users could execute attacker-controlled code simply by following the documented setup steps.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The command `npx clawhub@latest install setup-local-testnet` explicitly tracks the latest release, causing arbitrary newly published code to be executed on user machines. This creates a supply-chain risk where a compromised publisher account, malicious release, or dependency hijack can lead to code execution during installation.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

One command gives you a full development environment with funded accounts,
  real Uniswap pools, and zero gas costs. Use when developing, testing, or
  demoing Uniswap agent workflows.
model: sonnet
allowed-tools:
  - mcp__uniswap__setup_local_testnet
  - mcp__uniswap__fund_test_account

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The invocation guidance includes broad phrases such as "Set up a dev environment" and "Create a test environment for my agent," which are not specific to Uniswap or local Anvil testnets. These phrases could cause unintended activation for unrelated development or testing tasks.

Static analysis

No suspicious patterns detected.