Uniswap Submit Limit Order

• Analyzed: May 12, 2026, 3:47 AM
• Findings: 1
• Version: 0.1.0
• Hash: ca37d6166e7afe196cf46e1a8e496ebab9507359dadfd42283c32416c728a476
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed for a legitimate financial operation (UniswapX limit orders). However, the `SKILL.md` file explicitly grants the AI agent access to powerful file system tools (`Read`, `Glob`, `Grep`) via the `allowed-tools` directive. While the skill's workflow does not instruct the agent to use these tools for malicious purposes, their inclusion creates a significant vulnerability to prompt injection attacks, allowing an attacker to potentially leverage the agent to read sensitive files or enumerate the file system, which is a risky capability not strictly necessary for the stated purpose.