Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Uniswap/uniswap-ai --skill configuratorgit clone --depth 1 https://github.com/Uniswap/uniswap-aiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/uniswap/uniswap-ai/configurator)<a href="https://agentmods.dev/skills/uniswap/uniswap-ai/configurator"><img src="https://agentmods.dev/badge/skills/uniswap/uniswap-ai/configurator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/uniswap/uniswap-ai/configurator"><img src="https://agentmods.dev/badge/skills/uniswap/uniswap-ai/configurator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 5 Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.Fix: Remove the model/provider override or disclose it prominently and require explicit operator approval before invoking an external coding CLI or billed model.
- medium Data Exfiltration · line 793 Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.07879 |
| Opus 5 | $0.00026 | $0.03939 |
| Sonnet 5 | $0.00010 | $0.01576 |
| Haiku 4.5 | $0.00005 | $0.00788 |
Grade A, and why
configurator scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
allowed-tools: Read, Write, Edit, Glob, Grep, Bash(curl:*), WebFetch, AskUserQuestion, cca-supply-schedule__generate_supply_schedule, cca-supply-schedule__encode_supply_schedule How it starts
The opening of the file, as written. The whole thing — 842 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CCA Configuration
Configure Continuous Clearing Auction (CCA) smart contract parameters for fair and transparent token distribution.
Runtime Compatibility: This skill uses
AskUserQuestionfor interactive prompts. IfAskUserQuestionis not available in your runtime, collect the same parameters through natural language conversation instead.
Instructions for Claude Code
When the user invokes this skill, guide them through a bulk interactive form configuration flow using AskUserQuestion. Collect parameters in batches to minimize user interaction rounds.
Bulk Interactive Form Rules
- Batch questions - Ask up to 4 questions at once using a single AskUserQuestion call
- Allow direct input - For fields requiring custom values (addresses, numbers):
- Provide a "Not available yet" or "Skip for now" option
- The "Other" option (automatically provided) allows direct custom input
- NEVER ask "Do you have X?" as a separate question
- Store answers - Keep track of all collected values in a configuration object
- Validate after collection - After each batch, validate all inputs before proceeding
- Show progress - After each batch, show which parameters are collected and which remain
Input Validation Rules
Rule 4 above says validate after each batch. This is what validating means. Most values below arrive by selecting one of the preset options, but any of them can instead arrive as free text: through the "Other" option, which AskUserQuestion provides on every question, and through plain conversation whenever AskUserQuestion is unavailable and the runtime-compatibility fallback above applies. A custom RPC endpoint is the clearest case, because the Network question lists named networks and no endpoint field, yet a user who rejects the public endpoints still supplies one through "Other" or in conversation. Validate every value against the checks below before writing it into the configuration file or interpolating it into a curl command. Do not look for an exemption: a value that really is one of the presets this skill offered passes every check trivially, and under the conversational fallback there is no way to establish where a value came from in the first place.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 842 lines · 52 tokens per session scan A 60fe645ae555
configurator is a skill published in the GitHub repository Uniswap/uniswap-ai (230 stars, last pushed today), licensed MIT. It adds 52 tokens to every session and 7,879 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
mpp-agent
Pay HTTP 402 APIs via Machine Payments Protocol (MPP).
bridge
Cross-chain token transfers using Wormhole and CCTP.
hyperliquid
Hyperliquid L1 perps DEX (69% market share).
marginfi
MarginFi — Solana lending and borrowing.
crypto-market-rank
Crypto market rankings and leaderboards. Query trending tokens, top searched tokens, Binance Alpha tokens, tokenized stocks, social hype sentiment ranks, smart money inflow token rankings, top meme token rankings from Pulse launchpad, and top trader PnL leaderboards. Use this skill when users ask about token rankings…
trading-signal
Subscribe and retrieve on-chain Smart Money signals. Monitor trading activities of smart money addresses, including buy/sell signals, trigger price, current price, max gain, and exit rate. Use this skill when users are looking for investment opportunities — smart money signals can serve as valuable references for…