Uniswap Pool Analysis

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:48 PM UTC
• Version: 0.1.0

Overview

This is a narrow Uniswap pool-analysis skill with no hidden execution behavior, but its README uses mutable install commands that users should pin or verify.

Before installing, prefer a pinned ClawHub or npm installer version and a fixed Git commit instead of a branch or @latest. Review the exact installer and skill revision you run, especially if using it in a wallet, trading, or production analytics environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:12

Finding

Unpinned npm CLIs and Mutable Remote Skill Source

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 12–18
Vulnerability Type: Supply-chain exposure through unpinned executable dependencies and mutable remote content
Risk Level: Medium

Vulnerable Code

bash

npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/uniswap-pool-analysis

Or via Clawhub:

bash

npx clawhub@latest install uniswap-pool-analysis

Technical Analysis

The installation instructions invoke npm-delivered command-line tools without pinning them to reviewed versions or verifying package integrity. The second command explicitly requests @latest, allowing its executed implementation to change independently of this audit.

The first command also installs skill content from a mutable GitHub branch path rather than from a specific reviewed commit. Consequently, both the installer implementation and the installed content can differ from what was available when this project was reviewed.

The external npm packages and remote repository content are not included in the audited project. Their behavior therefore cannot be verified from the available files. No currently malicious payload was demonstrated; the vulnerability is the unsafe trust placed in mutable supply-chain components.

Attack Path

1. An attacker compromises an npm publisher account, an upstream dependency, the Clawhub package source, or the referenced GitHub repository.
2. The attacker publishes a modified CLI release or changes content on the referenced mutable branch.
3. A user follows the documented installation instructions.
4. npx downloads and executes the unreviewed package version under the user's account, or the installer retrieves altered skill content from the mutable source.
5. The compromised component can execute code with the installing process's permissions or install malicious skill instructions that affect later agent sessions.

Impact Assessment

A ...[truncated 633 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each npm CLI to an exact, reviewed version instead of relying on an implicit version or @latest.
2. Replace the GitHub branch URL with a reviewed commit hash so installed content is immutable.
3. Record and verify package integrity hashes or signatures where supported.
4. Use a lockfile or controlled internal registry to ensure reproducible dependency resolution.
5. Review the CLI package, its transitive dependencies, and the exact remote skill revision before recommending execution.
6. Run installation in a sandbox or least-privileged environment without sensitive environment variables or unrelated project access.
7. Document the expected package version, commit identifier, publisher, and integrity value so users can verify the installation source.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to execute a package via npx skills without pinning a specific version, which creates a supply-chain risk: users may fetch and run whatever version is current at install time. If the package is compromised, typosquatted, or a malicious version is later published, installation can execute attacker-controlled code on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README also uses npx clawhub@latest install, and @latest is effectively unpinned and mutable over time. This exposes users to the risk of executing newly published or compromised code during installation, turning the documentation itself into a delivery path for supply-chain compromise.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.