ClawHub
Back to skill

Security audit

CAI: hyperliquid-with-cai

Security checks across malware telemetry and agentic risk

Overview

This skill is clearly for CAI-based Hyperliquid perpetuals trading, but it enables high-risk live trading and deposits without enough risk disclosure or confirmation guidance.

Review this carefully before installing. Only use it if you understand CAI and Hyperliquid perpetuals, are comfortable granting the requested CAI API scope, and will require explicit confirmation for deposits, order placement, closes, and cancels. Treat all trading as high risk and verify preflight results, asset, size, price, direction, and account balances before acting.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill enables live perpetual futures trading and optional deposits, but it does not clearly warn users about leverage, liquidation, volatility, or the possibility of losing deposited funds. In a trading automation context, omission of basic financial risk disclosures can lead users to take high-risk actions without informed consent, especially when the flow emphasizes quick enrollment and execution.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.