Hyperliquid CLI (with HIP3 Support)

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:19 AM UTC
• Version: 1.0.3

Overview

This skill is a real trading tool that is mostly transparent, but it gives agents live financial authority and includes under-scoped examples for private keys, leveraged orders, and exporting sensitive position data.

Install only if you intentionally want an agent-accessible CLI that can trade with real funds. Use testnet first, prefer a dedicated low-balance or restricted API wallet, avoid storing raw private keys in shell profiles or shared environments, verify the npm package source, and do not copy webhook or logging examples unless the destination and retention controls are fully under your control.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The example pipes live account position data to an arbitrary external webhook, which creates a clear data exfiltration path for sensitive trading information such as holdings, entry prices, and PnL. In a trading skill, sharing data with third-party endpoints may be legitimate for integrations, but providing a generic exfiltration example without warning, scope limitation, or trust guidance makes accidental leakage more likely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill provides concrete commands for live order placement, shorting, leverage changes, and market orders against mainnet-capable infrastructure without prominent warnings that these actions are real, financially risky, and potentially irreversible. In the context of an agent skill, this increases the chance that a user or automation could execute unintended trades with real funds, especially because the skill also requests a private trading key and emphasizes low-latency execution.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation shows transmitting account position data to an external webhook without any privacy or security warning. This can expose sensitive financial telemetry and trading behavior to third parties, which is especially risky in a high-frequency trading context where positions and timing are valuable.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The setup flow instructs users to enter a private key but does not warn about secure handling, storage, or the danger of exposing credentials. Because this skill directly enables trading, compromise of that key could allow full unauthorized account activity and asset loss.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The examples encourage changing leverage and placing live orders without a prominent financial-risk warning or first directing users to testnet. In a leveraged trading context, this increases the chance of user harm through accidental losses, especially for new users following copy-paste examples.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This section documents live trading actions such as placing market and limit orders, setting leverage, and canceling orders without any warning that these actions can cause immediate and irreversible financial loss. In a trading skill, omission of safety guidance materially increases the chance that an agent or user will execute destructive or unintended transactions, especially with leveraged instruments and market orders.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs users to enter a private key for an API wallet and later advertises environment-variable based key usage, but it does not warn that private keys are highly sensitive secrets that can be exposed through shell history, process listings, logs, screenshots, or misconfigured environments. In a financial trading context, disclosure of the private key can directly lead to account takeover and unauthorized trading or fund loss.

External Transmission

Medium

• Category: Data Exfiltration

Content

hl account positions --json | jq -r '.positions[] | [.coin, .size, .entryPx, .unrealizedPnl] | @csv'

# Send to monitoring service
hl account positions --json | curl -X POST -d @- https://your-webhook.com/positions

# Log to file with timestamp
echo "{\"timestamp\": \"$(date -Iseconds)\", \"data\": $(hl account positions --json)}" >> positions.log

• Confidence: 93% confidence
• Finding: curl -X POST -d

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.