Security audit

Liquidskills

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent Hyperliquid development documentation, but it gives conflicting instructions for a real fund-transfer bridge operation and includes risky install guidance.

Review and correct the HYPE bridge instructions against current official Hyperliquid documentation before using this skill for any wallet, bridge, contract, or UI flow. Run remote installers and package installs only in a clean development environment without production wallet keys or sensitive credentials, and test all transaction flows on testnet first.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: tools/SKILL.md:24
Finding: Unverified Remote Foundry Installer Is Piped Directly into Bash
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: frontend-playbook/SKILL.md:24
Finding: Unpinned Third-Party Dependencies and Package-Executed Setup Commands
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: architecture/SKILL.md:181
Finding: Contradictory HYPE Bridge-Direction Instructions Can Cause Incorrect Fund Transfers
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (75)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · frontend-playbook/SKILL.md (reported line 42)May include surrounding context.
.gitignore must include:

text
.env .env.local .env.*.local

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · frontend-playbook/SKILL.md (reported line 328)May include surrounding context.
.gitignore must include:

text
.env .env.local .env.*.local

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · frontend-ux/SKILL.md (reported line 369)May include surrounding context.
.gitignore must include:

text
.env .env.local .env.*.local

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · orchestration/SKILL.md (reported line 64)May include surrounding context.
.gitignore must include:

text
.env .env.local .env.*.local

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · orchestration/SKILL.md (reported line 153)May include surrounding context.
.gitignore must include:

text
.env .env.local .env.*.local

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · qa/SKILL.md (reported line 104)May include surrounding context.
.gitignore must include:

text
.env .env.local .env.*.local

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · wallets/SKILL.md (reported line 180)May include surrounding context.
.gitignore must include:

text
.env .env.local .env.*.local

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · frontend-playbook/SKILL.md (reported line 43)May include surrounding context.
.gitignore must include:

text
.env .env.local .env.*.local

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · frontend-playbook/SKILL.md (reported line 295)May include surrounding context.
.gitignore must include:

text
.env .env.local .env.*.local

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · orchestration/SKILL.md (reported line 332)May include surrounding context.
.gitignore must include:

text
.env .env.local .env.*.local

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · testing/SKILL.md (reported line 316)May include surrounding context.
md
[ ] All unit tests pass locally [ ] Fuzz tests run with at least 10,000 runs (FOUNDRY_FUZZ_RUNS=10000) [ ] Invariant tests find no violations [ ] Contract compiles without warnings [ ] No hardcoded addresses — use constructor params or config files [ ] Deployment script tested locally with `--dry-run` [ ] Contract verified on testnet explorer after deploy

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The command pipes a remotely fetched script directly into bash, which allows arbitrary code execution if the remote server, transport, or install script is compromised. In a security context this is a well-known unsafe installation pattern because users execute unaudited code immediately on their machine.
Content: Scanner excerpt · tools/SKILL.md (reported line 26)May include surrounding context.
bash
# Install Foundry curl -L https://foundry.paradigm.xyz | bash foundryup # Initialize a project

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The '| bash' construct is the dangerous part of the install command because it chains network retrieval directly into shell execution without review. This reduces user opportunity to inspect the payload and makes compromise of the upstream source immediately exploitable on developer systems.
Content: Scanner excerpt · tools/SKILL.md (reported line 26)May include surrounding context.
bash
# Install Foundry curl -L https://foundry.paradigm.xyz | bash foundryup # Initialize a project

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · addresses/SKILL.md (reported line 100)May include surrounding context.
Perp markets — use asset index from meta.universe:

python
meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · addresses/SKILL.md (reported line 109)May include surrounding context.
Perp markets — use asset index from meta.universe:

python
meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · architecture/SKILL.md (reported line 258)May include surrounding context.
Perp markets — use asset index from meta.universe:

python
meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · architecture/SKILL.md (reported line 266)May include surrounding context.
Perp markets — use asset index from meta.universe:

python
meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · building-blocks/SKILL.md (reported line 119)May include surrounding context.
Perp markets — use asset index from meta.universe:

python
meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · building-blocks/SKILL.md (reported line 123)May include surrounding context.
Perp markets — use asset index from meta.universe:

python
meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · building-blocks/SKILL.md (reported line 127)May include surrounding context.
Perp markets — use asset index from meta.universe:

python
meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · building-blocks/SKILL.md (reported line 133)May include surrounding context.
Perp markets — use asset index from meta.universe:

python
meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · building-blocks/SKILL.md (reported line 170)May include surrounding context.
Perp markets — use asset index from meta.universe:

python
meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · building-blocks/SKILL.md (reported line 174)May include surrounding context.
Perp markets — use asset index from meta.universe:

python
meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · concepts/SKILL.md (reported line 215)May include surrounding context.
Perp markets — use asset index from meta.universe:

python
meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · addresses/SKILL.md (reported line 100)May include surrounding context.
Perp markets — use asset index from meta.universe:

python
meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0