Uniswap Swap Simulation

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:49 PM UTC
• Version: 0.1.0

Overview

The skill content is coherent and not destructive, but its README recommends unpinned remote install commands that execute mutable code and should be reviewed before use.

Review the install path before running the README commands. Prefer a pinned clawhub version and an immutable Git commit or release tag, and use the skill for simulation and risk analysis only, not as authority to execute trades or handle private wallet material.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:7

Finding

Unpinned Packages and Mutable Sources Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 7-17
Vulnerability Type: Unpinned third-party dependencies and mutable remote installation sources
Risk Level: Medium

Vulnerable Code

bash

npx skills add https://github.com/wpank/Agentic-Uniswap/tree/main/.ai/skills/uniswap-swap-simulation

bash

npx clawhub@latest install uniswap-swap-simulation

Technical Analysis

The documented installation procedures instruct users to download and execute third-party CLI packages through npx without pinning them to immutable, reviewed versions.

The clawhub@latest reference explicitly executes whichever package version currently holds the mutable latest tag. The skills package is also invoked without an exact version. In addition, the first command installs content from the mutable GitHub main branch rather than from a specific commit SHA.

Consequently, the code executed by these commands can change after this project has been reviewed. A compromised registry account, malicious package release, altered distribution tag, compromised upstream repository, or unauthorized branch modification could substitute attacker-controlled code without requiring changes to the audited files.

Attack Path

1. An attacker compromises the maintainer account, package registry account, upstream repository, or publishing pipeline associated with skills, clawhub, or the referenced GitHub project.
2. The attacker publishes a malicious package version, moves the latest tag, or modifies content on the referenced main branch.
3. A user follows an installation command from README.md.
4. npx resolves, downloads, and executes the altered CLI package on the user's system.
5. The malicious installer runs with the privileges of the invoking user and may modify files, access user-readable information, install additional payloads, or alter development tooling.

Impact Assessment

Successful exploitation permits arbitrary code executio ...[truncated 552 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every npx CLI dependency to an exact, reviewed version instead of using @latest or implicit version resolution:

   bash

   npx --yes clawhub@X.Y.Z install uniswap-swap-simulation
   npx --yes skills@X.Y.Z add ...
   

2. Replace the mutable GitHub branch reference with a reviewed commit SHA or immutable release tag.
3. Publish expected checksums or signatures for downloaded artifacts and verify them before installation.
4. Use package-manager lockfiles where installation occurs within a managed project.
5. Review package provenance, registry ownership, release signatures, and publishing workflows.
6. In CI or other sensitive environments, run installation inside a sandbox or minimally privileged container with restricted credentials, filesystem access, and network access.
7. Avoid executing remotely resolved installers directly when a verifiable download-and-inspect workflow is available.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to execute an unpinned package via npx, which fetches and runs the latest published code at install time. If the package is compromised, typosquatted, or updated maliciously, users could execute arbitrary code on their machines during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The command uses npx to run the latest clawhub package without pinning a version, creating a supply-chain execution risk. Because npx downloads and executes remote package code immediately, any compromise of the package or its publishing account can lead to arbitrary code execution on the user's system.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description uses broad trigger language ('Use when the user asks about swap execution, routing, price impact, or MEV considerations') without clear boundaries, which can cause the skill to activate in a wider set of finance or trading conversations than intended. Over-broad activation increases the chance the agent invokes this skill in contexts involving live financial decision-making, where inaccurate assumptions or incomplete risk framing could mislead users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.