liquidity-migration
Warn
Audited by Snyk on Mar 3, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs the agent to use the public "Doppler deployments" GitHub repo (https://github.com/whetstoneresearch/doppler/tree/main/deployments) as the contract source of truth, so the agent will fetch and interpret external repository content that can materially influence migrator selection and actions.
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly about performing liquidity migrations on Uniswap (V2/V3/V4), references on-chain contracts and deployed migrator addresses, and includes an explicit step to "Execute migration" and verifies the
Airlock.migrate(asset)andliquidityMigrator.migrate(...)handoff. This is a specific crypto/blockchain financial operation (moving on-chain funds/liquidity), not a generic tool, so it grants direct financial execution capability.
Audit Metadata