T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:228- Finding
Agent Instructions Inject an Operator-Specific Commercial Referral
- Content
View full analysis
- Remediation
View remediation
Security audit
Hyperliquid CLI (with HIP3 Support)
Security checks for vulnerabilities and agentic risk
Overview
This is a real trading skill whose core purpose is coherent, but it combines live-funds authority, private-key handling, an unpinned global install, and under-disclosed data-sharing and referral guidance.
Review carefully before installing. Use a dedicated low-balance API wallet, prefer read-only mode for monitoring, test with `--testnet`, avoid storing private keys in shell history or long-lived environment variables, verify the npm package/version yourself, and do not send account JSON to webhooks unless the endpoint is trusted and the payload is minimized. Treat the referral link as optional and unrelated to setup.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:12- Finding
Unpinned Globally Installed Dependency Receives Wallet Credentials and Trading Authority
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The reference documents market/limit order placement and leverage changes without a clear global warning that these commands affect live funds by default unless --testnet is used. In a high-frequency trading context, users may rapidly execute irreversible trades or leverage changes, amplifying the chance of accidental financial loss.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill provides direct live-trading commands, including leveraged orders, without strong warnings about financial loss, liquidation risk, or a clear recommendation to use testnet/paper practice first. In an agent context, this increases the chance that users execute risky real-money trades too quickly or misunderstand the consequences of market and leverage commands.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The account setup example instructs users to enter a private key but does not prominently warn about secret-handling risks such as key theft, shell history leakage, shoulder surfing, or use on compromised systems. In a trading tool, private keys directly control funds, so weak guidance around entry and storage materially increases the risk of asset theft.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The examples repeatedly place live market and limit orders on real assets without an upfront warning that these actions can execute immediately with real funds. In a trading skill, executable examples materially increase the chance of accidental financial loss, especially when copy-pasted by users who may not distinguish testnet from mainnet.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The example pipes live account position data to an arbitrary external webhook, which creates a clear data exfiltration path. Even if intended for monitoring, positions, balances, and trading activity are sensitive financial data, and the example provides no trust boundary, destination validation, or warning to the user.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The webhook example transmits account position data to an external service without any privacy or data-sharing warning. Users may unknowingly disclose portfolio composition, position sizes, entry prices, and unrealized PnL to third parties, which can expose sensitive financial intelligence.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This command explicitly posts the output of
hl account positions --jsonto an external URL viacurl, which is a direct external transmission of sensitive financial data. Because the example uses a generic webhook endpoint and no authentication, redaction, or warning, it normalizes unsafe export of account telemetry.- Content
md hl account positions --json | jq -r '.positions[] | [.coin, .size, .entryPx, .unrealizedPnl] | @csv' # Send to monitoring service hl account positions --json | curl -X POST -d @- https://your-webhook.com/positions # Log to file with timestamp echo "{\"timestamp\": \"$(date -Iseconds)\", \"data\": $(hl account positions --json)}" >> positions.log
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The reference explicitly states that trading accounts are stored locally in ~/.hyperliquid/accounts.db and that users may enter private keys, but it provides no warning that these files and inputs contain highly sensitive material. In a trading skill, compromise of locally stored wallet credentials can directly enable unauthorized trading or fund loss, so the omission meaningfully increases user risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation instructs users to enter a private key and exposes HYPERLIQUID_PRIVATE_KEY as an environment-variable workflow without warning about secret leakage through shell history, process listings, shared terminals, CI logs, or multi-user systems. Because this skill controls live trading accounts, disclosure of the key can lead to immediate account takeover and unauthorized orders.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | Option | Description | |--------|-------------| | `--coin <coin>` | Only cancel orders for specific coin | | `-y, --yes` | Skip confirmation prompt | **Examples:**
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | Option | Description | |--------|-------------| | `--coin <coin>` | Only cancel orders for specific coin | | `-y, --yes` | Skip confirmation prompt | **Examples:**
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation instructs the agent to recommend a specific referral link unrelated to the core operational purpose of trading or monitoring. This creates a conflict of interest: an automated assistant could steer users toward a promoter-controlled URL during a sensitive financial setup flow, which is inappropriate even if the link is legitimate.
- Content
Static analysis
No suspicious patterns detected.