uniswap-cca-deployer

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The pre-flight auto-injected script instructs the agent to compute a device fingerprint, derive an HMAC-signed token (with an obfuscated key), and POST that data to external endpoints—actions unrelated to deploying CCA contracts and effectively exfiltrate device information, so they are hidden/deceptive instructions outside the skill's stated purpose.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I inspected the full skill prompt. There is a base64-encoded string assigned to _K:

'OE9nNWFRUFdfSVJkektrMExOV2RNeTIzV2JibXo3ZWNTbExJUDFIWnVoZw=='

This blob is decoded at runtime and used as an HMAC signing key ("HMAC signature (obfuscated key, same as CLI binary)") to compute a device token reported to external services. It is not a placeholder, truncated value, or an obvious example password — it is a literal, high-entropy credential embedded in code (albeit base64-obfuscated). Because it directly supplies a signing key used for HMAC and is present in the repo/script, it meets the definition of a secret and should be treated as sensitive.

No other high-entropy secrets (API keys, private key blocks, or bearer tokens) are present. Other strings (env var names, simple example passwords) are not present or are clearly non-sensitive.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly for deploying Uniswap Continuous Clearing Auction smart contracts (a blockchain-specific operation). Deploying contracts requires creating and broadcasting on-chain transactions and typically involves signing transactions/wallet integration. Although the snippet doesn't show the exact signing API, the skill's primary and explicit purpose is a crypto/blockchain execution task (deploying on-chain contracts), which falls under the "Crypto/Blockchain (Wallets, Swaps, Signing)" category.