Versioned security assessment

Report ID: SA-82CE9E44

7/5/2026, 1:23:50 AM

uniswap security assessment v8

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
uniswap
Version
v8
Maintainer
ApeWorX
Source
github.com/ApeWorX/skills/tree/main/protocols/uniswap
Coverage
1 Files scanned · 50 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Medium

1 confirmed security finding requires attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

No malware, prompt injection attempt, credential access, or unauthorized exfiltration was found. The shell execution alerts are Markdown formatting false positives, while the skill does require low-risk public documentation fetches and includes medium financial risk because Uniswap trades can move user funds.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 50 Lines analyzed

8 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 7 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 9 evidence locations

Capability review items (7)
Low
SKILL.md:15
Hardcoded URL
1. Use `web_fetch` to retrieve the latest documentation from https://github.com/ApeWorX/uniswap-sdk/
The skill explicitly tells the agent to use web_fetch against a GitHub documentation URL. This is a legitimate public documentation dependency, but it is still outbound network access to mutable remote content.
Low
SKILL.md:16
Hardcoded URL
2. Use `web_fetch` to retrieve the latest Ape documentation from https://docs.apeworx.io/ape/stable
The skill explicitly instructs web_fetch against the Ape documentation site. The URL appears legitimate, but it creates a low-risk external network dependency.
Low
SKILL.md:17
Hardcoded URL
3. Use `web_fetch` to retrieve the latest `ape-tokens` documentation from https://github.com/ApeWorX
The skill instructs web_fetch against the ApeWorX ape-tokens documentation. This is appropriate for current docs, but it remains outbound access to external content.
Low
SKILL.md:19
Hardcoded URL
- Usage guide: https://github.com/ApeWorX/uniswap-sdk/blob/main/README.md#quick-usage
This URL is listed under relevant pages to fetch for the usage guide. It is a public GitHub documentation link, so the risk is limited to remote content dependence.
Low
SKILL.md:20
Hardcoded URL
- Installing a tokenlist using `ape-tokens`: https://github.com/ApeWorX/ape-tokens/blob/main/README.
This URL is listed as a page to fetch for tokenlist setup. It is not exfiltration, but it does require external network access to GitHub-hosted content.
Low
SKILL.md:21
Hardcoded URL
- Setting up an account with Ape: https://docs.apeworx.io/ape/stable/userguides/accounts#live-networ
This URL points to Ape account setup documentation and is part of the requested documentation fetch flow. It is low risk because no secrets are sent, but it depends on external content.
Low
SKILL.md:43
Hardcoded URL
This SDK was specifically designed for use within a bot: https://github.com/ApeWorX/uniswap-sdk/blob
The line links to Silverback usage documentation for the SDK. It is a benign documentation reference, but it still introduces a low-risk external URL dependency.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (1)

RISK-001 Medium
SKILL.md:36-39
On-Chain Trading Can Move User Funds
The skill covers Uniswap trades and warns that trading is risky. Agent-assisted swaps can transfer user funds, so quotes, slippage, token addresses, network, and explicit user approval must be verified before execution.
Lines 36-39 explicitly discuss performing trades, querying prices, user confirmation, and small test swaps. This confirms a legitimate but financially sensitive workflow.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    Uniswap swap workflows can transfer real funds.
    Require explicit user approval with network, token addresses, amount, route, quote, slippage, gas estimate, and recipient before any transaction is submitted.
  2. FIX-002
    Medium
    Token and route selection can cause financial loss if stale or incorrect.
    Verify token contracts through trusted tokenlists, query live prices, and keep the small test swap requirement for new or large trades.
  3. FIX-003
    Low
    External documentation fetches are required before code generation.
    Limit fetching to the listed ApeWorX and Ape documentation pages, review remote content before using it, and never include secrets in fetch prompts or URLs.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable