Uniswap Track Performance

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:48 PM UTC
• Version: 0.1.0

Overview

The skill is mostly a read-only Uniswap LP tracker, but it tells users to configure a private wallet key even though tracking should only need public data.

Review this skill before installing. It should not require a private key for performance tracking; use a public wallet address only, and do not provide seed phrases, private keys, or signing credentials. Prefer pinned install sources or a reviewed ClawHub version rather than mutable latest/main references.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:10

Finding

Unpinned Third-Party Installation Commands Permit Supply-Chain Code Execution

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 10-18
Vulnerability Type: Unpinned and mutable third-party installation sources
Risk Level: Medium

Vulnerable Code

markdown

Install into Claude Code or Cursor with:

```bash
npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/track-performance

Or via Clawhub:

bash

npx clawhub@latest install track-performance

text

### Technical Analysis

The documented installation process executes npm-delivered tooling without pinning it to an immutable version or verifying its integrity. In particular, `npx clawhub@latest` explicitly retrieves the latest available package release. The `npx skills` package is also unversioned, while the skill content is retrieved from the mutable `main` branch of an external GitHub repository.

Consequently, the code executed or installed at audit time may differ from the code executed by a user later. This creates a supply-chain trust boundary in which compromise of an npm publisher, package, GitHub account, repository, branch, or distribution infrastructure could introduce attacker-controlled code.

The audited files do not establish that either referenced package or repository is currently malicious. The vulnerability is the absence of immutable version pinning and integrity verification.

### Attack Path

1. An attacker compromises the npm account, package, GitHub repository, or another component of the referenced distribution chain.
2. The attacker publishes a malicious package release or modifies content on the referenced `main` branch.
3. A user follows the README and runs one of the documented `npx` commands.
4. `npx` downloads and runs the mutable package version, or the installer retrieves the modified repository content.
5. Attacker-controlled installer or lifecycle code executes with the privileges of the user running the command.

### Impact Assessment

Successful e
...[truncated 388 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every npm tool to a reviewed, explicit version instead of relying on an implicit version or @latest.
• Reference the GitHub-hosted skill using an immutable commit hash or signed release tag rather than the mutable main branch.
• Verify package and downloaded artifact integrity using trusted checksums, lockfiles, provenance attestations, or signature verification.
• Document the expected package publisher and repository ownership so users can verify sources before installation.
• Review package lifecycle scripts and use an installation mechanism that disables unnecessary scripts where supported.
• Periodically review pinned versions and update them through a controlled security-review process.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:71

Finding

Read-Only Portfolio Tracking Instructs Users to Configure a Private Key

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 71-75
Vulnerability Type: Excessive credential and signing privilege requirement
Risk Level: Medium

Vulnerable Code

markdown

| Error                | User-Facing Message                              | Suggested Action              |
| -------------------- | ------------------------------------------------ | ----------------------------- |
| Wallet not configured | "No wallet configured."                          | Set WALLET_TYPE + PRIVATE_KEY |
| No positions found   | "No Uniswap positions found."                    | Wallet may not have LP'd      |
| Data stale           | "Position data may be delayed."                  | Try again in a few minutes    |

Technical Analysis

The skill is documented as a read-only performance-monitoring workflow. Determining LP position status, balances, ranges, and uncollected fees normally requires only a public wallet address and public blockchain data. Nevertheless, the error-handling guidance tells users to configure PRIVATE_KEY.

A private key provides transaction-signing authority and therefore grants substantially more privilege than the stated task requires. Placing this credential in the agent environment may expose it to delegated tooling, subprocesses, dependencies, logs, diagnostics, or future functionality operating within the same environment.

No code in the audited project directly reads, transmits, or abuses the private key, and no unauthorized transaction logic was found. The risk arises from unnecessary credential provisioning and the resulting violation of least privilege.

Attack Path

1. A user invokes the skill without a configured wallet and receives the documented wallet-configuration error.
2. Following the suggested action, the user places a wallet private key in an environment variable or agent configuration.
3. The skill delegates processing to `Task(subagent_type:port ...[truncated 766 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the private-key instruction with configuration of a public wallet address only.
• Explicitly state that users must not provide private keys, seed phrases, signing credentials, or exchange API secrets for performance tracking.
• Ensure the delegated portfolio analyst receives only the public address, requested chains, and reporting period.
• If future functionality genuinely requires signing, isolate it from read-only analysis and require explicit confirmation for each transaction.
• Use a scoped wallet provider, hardware wallet, or transaction policy system rather than exposing raw private-key material to the agent environment.
• Prevent secrets from appearing in prompts, logs, error messages, telemetry, or delegated-task parameters.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run npx skills add against a remote GitHub repository without pinning an immutable version, tag, or commit. This creates a supply-chain risk: if the package or fetched skill contents change upstream, users may install unexpected or malicious code or configuration later without noticing.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The command npx clawhub@latest install track-performance explicitly pulls the latest available package version at install time, which is non-deterministic and vulnerable to upstream compromise or malicious updates. An attacker who compromises the package, publisher account, or dependency chain could deliver altered code to anyone following the README instructions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The top-level description uses broad phrasing like 'when the user asks how their positions are doing,' which can overlap with general portfolio/status requests and cause the skill to activate outside its intended Uniswap-LP scope. In an agent system, over-broad triggering can route unrelated user requests into a specialized financial workflow, causing incorrect handling, privacy overreach on wallet data, or inappropriate delegation to a portfolio-analysis subagent.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: track-performance
description: Track the performance of Uniswap LP positions over time — check which positions need attention, are out of range, or have uncollected fees. Use when the user asks how their positions are doing.
model: opus
allowed-tools: [Task(subagent_type:portfolio-analyst)]
---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example trigger phrases are short, generic, and lack exclusion criteria, so common requests like 'How are my positions doing?' or 'Any positions need attention?' may match many non-Uniswap contexts. This ambiguity increases the chance of misrouting sensitive financial queries to the wrong skill and may expose wallet-specific analysis or produce misleading advice for assets the skill is not designed to evaluate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.