Uniswap Submit Limit Order

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:49 PM UTC
• Version: 0.1.0

Overview

The skill matches its stated UniswapX limit-order purpose, but it can submit live crypto orders from broad prompts without an explicit confirmation step and its install instructions use mutable remote sources.

Review before installing. Use pinned or immutable install sources where possible, restrict enabled tools to the intended Uniswap account and chain, and require the agent to show full order details and wait for explicit approval before any live order is submitted.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:12

Finding

Unpinned Installation Tools and Mutable Remote Skill Sources

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 12–18
Vulnerability Type: Unpinned third-party dependencies and mutable remote sources
Risk Level: Medium

Vulnerable Code

bash

npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/submit-limit-order

Or via Clawhub:

bash

npx clawhub@latest install submit-limit-order

Technical Analysis

The documented installation procedures use remotely resolved npm packages without pinning them to reviewed versions. The second command explicitly requests the mutable latest release of clawhub. The first command invokes the unversioned skills package and installs Skill content from the mutable GitHub main branch.

Neither procedure specifies a package version, immutable commit hash, artifact checksum, digital signature, or integrity-verification step. Therefore, the components executed or installed by these commands can change after this project has been audited.

This creates a supply-chain trust boundary in which compromise of the npm package, package publisher, registry account, GitHub repository, or upstream maintainer could replace reviewed behavior with attacker-controlled content.

Attack Path

1. An attacker compromises an upstream npm publisher account, the relevant GitHub account, repository write access, or another part of the distribution infrastructure.
2. The attacker publishes a malicious package version under the package resolved by npx, changes the package tagged as latest, or modifies content on the GitHub main branch.
3. A user follows the installation instructions in README.md.
4. npx downloads and invokes the currently resolved package rather than a previously reviewed immutable version.
5. The installer retrieves or installs the attacker-modified Skill content.
6. Malicious installation-time behavior may execute with the invoking user's privileges, or altered Skill instructi ...[truncated 907 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every npm command to an exact, reviewed version rather than relying on implicit resolution or @latest.
2. Replace the GitHub main branch URL with an immutable, reviewed commit hash or a signed release tag whose underlying commit is protected against modification.
3. Publish and verify cryptographic checksums for downloaded Skill artifacts before installation.
4. Prefer signed packages or releases and document how users should verify publisher identity and signatures.
5. Use lockfiles or an equivalent reproducible dependency manifest where supported.
6. Disable or review package lifecycle scripts during installation, and perform installation in a sandbox or least-privileged environment.
7. Add a documented update process requiring security review before changing pinned versions or commit hashes.
8. Provide the expected package versions, commit identifier, and artifact digest directly in README.md so users can verify that they are installing the audited release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to execute an unpinned package via npx skills add ..., which fetches and runs code without locking the package version or verifying integrity. If the skills package or one of its resolved dependencies is compromised or changed upstream, users installing this wallet-related skill could execute attacker-controlled code on their machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The command npx clawhub@latest install submit-limit-order explicitly requests the latest version, making the installation non-reproducible and vulnerable to upstream package compromise or malicious updates. Because this skill is for submitting UniswapX limit orders, any compromised installer could tamper with wallet-related workflows, exfiltrate secrets, or alter transaction parameters.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

mcp__uniswap__submit_uniswapx_order,
  mcp__uniswap__get_uniswapx_order_status,
  mcp__uniswap__check_safety_status
model: opus
---

# Submit Limit Order

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill operationalizes submission of a live trading order but does not require a user-facing warning or confirmation about order commitment, Dutch auction decay, expiry, fill uncertainty, or execution at potentially different terms than the initial quote. In a financial trading context, this omission can directly lead to unintended economic loss or user surprise because the skill moves from intent extraction to order submission without an explicit consent gate.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation phrases are broad enough to match ordinary trading requests like 'Buy X at price Y' or 'Limit buy/sell' without clearly requiring an explicit instruction to place a live UniswapX order. In a skill that can submit a real order, overbroad activation increases the chance of unintended invocation and accidental order placement through ambiguous user intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.