All 17 static findings are false positives: backticks mark inline code, URLs reference relevant public documentation, and token symbols are not reconnaissance. The skill still presents contextual risks because it relies on mutable remote documentation and can generate workflows that trade real assets through configured accounts. Publication should require transaction confirmation and remote-content safeguards.
The skill supports swaps through configured Ape accounts and automated bot workflows. Generated code may sign or broadcast transactions that cause irreversible financial loss.
The skill explicitly covers trading, requires configured Ape accounts, and recommends bot integration, so real-asset transaction capability is clear.
The skill requires fetching documentation from mutable branch and stable-channel URLs before coding. Compromised or injected content could influence generated transaction logic.
The instructions explicitly require retrieving unpinned remote pages before implementation, creating a clear external-content trust dependency.
The static command-execution findings are false positives caused by Markdown inline code formatting. The hardcoded URLs are public ApeWorX and Ape documentation references, and no prompt injection, credential access, or data exfiltration intent was found in SKILL.md.
No malware, prompt injection attempt, credential access, or unauthorized exfiltration was found. The shell execution alerts are Markdown formatting false positives, while the skill does require low-risk public documentation fetches and includes medium financial risk because Uniswap trades can move user funds.
The skill covers Uniswap trades and warns that trading is risky. Agent-assisted swaps can transfer user funds, so quotes, slippage, token addresses, network, and explicit user approval must be verified before execution.
Lines 36-39 explicitly discuss performing trades, querying prices, user confirmation, and small test swaps. This confirms a legitimate but financially sensitive workflow.
Capability review items (7)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
1. Use `web_fetch` to retrieve the latest documentation from https://github.com/ApeWorX/uniswap-sdk/
The skill explicitly tells the agent to use web_fetch against a GitHub documentation URL. This is a legitimate public documentation dependency, but it is still outbound network access to mutable remote content.
2. Use `web_fetch` to retrieve the latest Ape documentation from https://docs.apeworx.io/ape/stable
The skill explicitly instructs web_fetch against the Ape documentation site. The URL appears legitimate, but it creates a low-risk external network dependency.
3. Use `web_fetch` to retrieve the latest `ape-tokens` documentation from https://github.com/ApeWorX
The skill instructs web_fetch against the ApeWorX ape-tokens documentation. This is appropriate for current docs, but it remains outbound access to external content.
This URL is listed under relevant pages to fetch for the usage guide. It is a public GitHub documentation link, so the risk is limited to remote content dependence.
- Installing a tokenlist using `ape-tokens`: https://github.com/ApeWorX/ape-tokens/blob/main/README.
This URL is listed as a page to fetch for tokenlist setup. It is not exfiltration, but it does require external network access to GitHub-hosted content.
- Setting up an account with Ape: https://docs.apeworx.io/ape/stable/userguides/accounts#live-networ
This URL points to Ape account setup documentation and is part of the requested documentation fetch flow. It is low risk because no secrets are sent, but it depends on external content.
This SDK was specifically designed for use within a bot: https://github.com/ApeWorX/uniswap-sdk/blob
The line links to Silverback usage documentation for the SDK. It is a benign documentation reference, but it still introduces a low-risk external URL dependency.
Static command-execution and weak-cryptography findings are false positives caused by Markdown inline code and blockchain terminology in SKILL.md. The real risks are external documentation fetching and guidance for live Uniswap trading, which can move user assets if used without confirmation.
The skill is designed for Uniswap trading and acknowledges that trades are risky. It instructs agents to query prices and ask the user before trading, but misuse could still result in unwanted swaps or financial loss.
The text directly discusses performing trades and mitigation steps. This is not malicious, but the workflow has clear financial impact.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill instructs agents to fetch Uniswap SDK, Ape, and ape-tokens documentation from GitHub and ApeWorX documentation sites. These are legitimate documentation URLs, and no evidence of data exfiltration was found.
The hardcoded URLs are visible and point to project documentation. The file does not instruct sending local files, secrets, or account data to those URLs.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
False Positive: Markdown Backticks Flagged as Commands
Static analysis flagged inline Markdown code spans as shell or Ruby backtick execution. SKILL.md is prose documentation and contains no executable script blocks or shell invocation.
The cited lines are Markdown text with inline code formatting. No command interpreter, script file, or dynamic execution context is present.
False Positive: Blockchain Terms Flagged as Weak Cryptography
The weak-cryptography findings appear to come from blockchain and trading terminology, not from use of weak algorithms. No evidence found of MD5, SHA-1, DES, RC4, or custom cryptography.
The cited lines describe Uniswap, Ape accounts, and documentation links. They do not name or invoke cryptographic algorithms.
False Positive: Token Names Flagged as System Reconnaissance
The system reconnaissance finding points to token symbols and routing guidance. No evidence found of host enumeration, process listing, network scanning, or environment inspection.
The line lists WETH, USDC, and USDT as possible route intermediates. Those are blockchain token symbols, not system reconnaissance commands.
Static analysis detected 36 potential issues, but manual review confirms these are false positives from markdown formatting and legitimate documentation URLs. The skill contains only instructional content for using the Uniswap SDK with proper risk warnings. Network risk factor is present due to documented references to GitHub documentation URLs.
2
Files scanned
512
Lines analyzed
2
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill contains references to external GitHub documentation URLs for web_fetch operations. These are legitimate instructional references to official ApeWorX documentation and are necessary for the skill to function properly by fetching current API documentation.
Prompt-only skill providing guidance for using uniswap-sdk. Contains no executable code, no file access, no network calls, and no command execution capabilities. Instructions focus on fetching documentation and safely interacting with the Uniswap DeFi protocol.
1
Files scanned
50
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Prompt-only skill providing guidance for using uniswap-sdk. Contains no executable code, no file access, no network calls, and no command execution capabilities. Instructions focus on fetching documentation and safely interacting with the Uniswap DeFi protocol.
1
Files scanned
50
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.
Prompt-only skill providing guidance for using uniswap-sdk. Contains no executable code, no file access, no network calls, and no command execution capabilities. Instructions focus on fetching documentation and safely interacting with the Uniswap DeFi protocol.
1
Files scanned
50
Lines analyzed
0
Review items
0
False positives ignored
No confirmed security findings were recorded for this completed audit.