Security audit

Liquidskills

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent Hyperliquid development documentation, but it gives conflicting instructions for a real fund-transfer bridge operation and includes risky install guidance.

Review and correct the HYPE bridge instructions against current official Hyperliquid documentation before using this skill for any wallet, bridge, contract, or UI flow. Run remote installers and package installs only in a clean development environment without production wallet keys or sensitive credentials, and test all transaction flows on testnet first.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: tools/SKILL.md:24
Finding: Unverified Remote Foundry Installer Is Piped Directly into Bash<![CDATA[ ## Vulnerability Details **File Location**: `tools/SKILL.md:24-27` **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High ### Vulnerable Code ```bash # Install Foundry curl -L https://foundry.paradigm.xyz | bash foundryup ``` ### Technical Analysis The installation instruction downloads mutable content from an external URL and pipes it directly into Bash. The response is not saved for inspection, pinned to a specific version, or validated using a cryptographic signature or checksum. The domain is presented as Foundry's installer source, and installing Foundry is consistent with the Skill's declared development-tooling purpose. Nevertheless, the command creates a remote code-execution channel: whatever content the endpoint returns at execution time receives the invoking user's shell privileges. This exceeds the minimum privilege necessary to document or install the tool because safer release-artifact and verification workflows are available. ### Attack Path 1. An attacker compromises the installer host, its deployment pipeline, DNS resolution, or another component capable of changing the HTTPS response. 2. The attacker modifies the returned installer script to include malicious shell commands. 3. A user or AI agent follows the Skill and runs the documented command. 4. Bash immediately executes the response without providing an opportunity to inspect or authenticate it. 5. The payload accesses files and credentials available to the invoking account or modifies that account's environment. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running the installation command. In the documented blockchain-development environment, that scope may include: - Wallet private keys exposed through environment variables or local configuration. - Deployment credentials and RPC provider tokens. - Source code and contract deployment artifacts. - Modific ...[truncated 370 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not pipe network responses directly into a shell. 2. Select and pin a reviewed Foundry release version. 3. Download the release artifact into a temporary directory without executing it. 4. Verify a publisher-provided cryptographic signature or a checksum obtained through an independently authenticated channel. 5. Inspect the downloaded file and execute it only after validation. 6. Run installation under an unprivileged, dedicated development account. 7. Keep wallet keys and production credentials out of the environment during tool installation. A safer conceptual workflow is: ```bash curl --fail --show-error --location \ --output foundry-installer.sh \ "https://reviewed.example/foundry-installer-VERSION.sh" printf '%s %s\n' 'PINNED_SHA256' 'foundry-installer.sh' | sha256sum --check - less foundry-installer.sh bash foundry-installer.sh ``` The actual artifact URL and checksum must come from authenticated official release metadata; placeholder values must not be used. ]]>

T08 · Insecure Dependencies

Warning

Location: frontend-playbook/SKILL.md:24
Finding: Unpinned Third-Party Dependencies and Package-Executed Setup Commands<![CDATA[ ## Vulnerability Details **File Locations**: - `tools/SKILL.md:183` - `tools/SKILL.md:223` - `frontend-playbook/SKILL.md:24-28` - `frontend-playbook/SKILL.md:97` - `testing/SKILL.md:229` **Vulnerability Type**: Unpinned software supply-chain dependencies **Risk Level**: Medium ### Vulnerable Code `tools/SKILL.md:183`: ```bash pip install hyperliquid-dex ``` `tools/SKILL.md:223`: ```bash npm install @nktkas/hyperliquid ``` `frontend-playbook/SKILL.md:24-28`: ```bash npm create vite@latest my-hl-app -- --template react cd my-hl-app npm install wagmi viem @tanstack/react-query npm install @supabase/supabase-js # if using Supabase npm install lightweight-charts # if building price charts ``` `frontend-playbook/SKILL.md:97`: ```bash npm install -g vercel ``` `testing/SKILL.md:229`: ```bash npm install --save-dev hardhat @nomicfoundation/hardhat-toolbox ``` ### Technical Analysis These instructions resolve package names to whatever versions package registries serve at installation time. `npm create vite@latest` explicitly selects a mutable latest release, while the remaining npm and pip commands omit exact versions and integrity constraints. Package installation can execute package-controlled code through mechanisms such as: - npm lifecycle scripts and executable package entry points. - `npm create` scaffolding packages. - Python source-distribution build backends and installation hooks. - Globally installed npm executables. The TypeScript Hyperliquid package is described by the Skill as community-maintained rather than official. That does not make it malicious, but it increases the importance of provenance review and version pinning. No evidence showed that the named packages are currently malicious. The confirmed issue is that the instructions provide no reproducible version or integrity boundary, leaving future installation behavior dependent on mutable external registry state. ### Attack Path 1. An upstream maintainer account, pac ...[truncated 1355 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every direct package to an exact reviewed version rather than using ranges or `latest`. 2. Commit lockfiles and use reproducible installation commands such as `npm ci`. 3. For Python, use an isolated virtual environment and a hash-locked requirements file, for example with `--require-hashes`. 4. Review package provenance, publisher identity, release history, and transitive dependencies before adoption. 5. Avoid global npm installation. Prefer a project-local pinned CLI invoked through the locked dependency graph. 6. Disable package lifecycle scripts where compatible, then explicitly enable only reviewed build steps. 7. Run dependency installation in a sandbox without wallet keys, production credentials, or signing access. 8. Add automated dependency scanning and lockfile integrity verification to CI. 9. Periodically review pinned versions and update them through controlled, tested pull requests. 10. Clearly distinguish official SDKs from community packages and document the additional review required for community-maintained components. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: architecture/SKILL.md:181
Finding: Contradictory HYPE Bridge-Direction Instructions Can Cause Incorrect Fund Transfers<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:47` - `architecture/SKILL.md:181-192` - `addresses/SKILL.md:13-16` **Vulnerability Type**: Unsafe and contradictory financial-operation guidance **Risk Level**: High ### Vulnerable Content `SKILL.md:47` states: ```text - 0x2222...2222 is the system address — send HYPE here to move it from HyperCore to HyperEVM. ``` `architecture/SKILL.md:181-192` contains a contradictory, self-correcting sequence: ```text - Method 1: On HyperEVM, send a transaction to `0x2222...2222` with HYPE value. This is counterintuitive — you're sending FROM HyperEVM TO the bridge address, and HYPE appears on HyperEVM. - Wait, actually: sending HYPE to `0x2222...2222` on HyperEVM **withdraws** it TO HyperCore. - Send HYPE to `0x2222222222222222222222222222222222222222` on HyperEVM - Use the `/exchange` API with action type `"spotSend"` or use the `"evmUserModify"` action - HYPE appears as HYPE token on HyperEVM ``` `addresses/SKILL.md:13-16` states: ```text | Name | Address | What It Does | |------|---------|-------------| | **HYPE Bridge (HyperCore → HyperEVM)** | `0x2222222222222222222222222222222222222222` | System address for HYPE transfers between layers | **The bridge address is deterministic and canonical.** Sending HYPE to this address on HyperEVM moves it to HyperCore. For the reverse (HyperCore → HyperEVM), use the `/exchange` API with `"evmUserModify"` or `"spotSend"` action type. ``` ### Technical Analysis The root Skill tells the agent that sending HYPE to the system address moves assets from HyperCore to HyperEVM. The address guide instead says that a transaction sent to the address on HyperEVM moves HYPE to HyperCore. The architecture guide first states an incoherent direction, then visibly corrects itself with “Wait, actually.” Because the root Skill acts as the project entry point, an agent may rely on its reversed summary without loading the more detailed address guide. The ambiguity affects an ...[truncated 1611 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove every contradictory statement and use one canonical direction throughout all Skills. 2. Based on the internally consistent detailed guidance, clearly state that sending HYPE from HyperEVM to `0x2222222222222222222222222222222222222222` moves it to HyperCore. 3. Document HyperCore-to-HyperEVM as a separate signed API operation, with exact and independently verified action semantics. 4. Remove conversational self-corrections such as “Wait, actually” from operational documentation. 5. Add explicit source-layer, destination-layer, chain ID, asset, amount, recipient, and expected post-transfer balance checks. 6. Require testnet validation before exposing either transfer direction in production. 7. Require human confirmation that displays the transfer direction before any signed mainnet operation. 8. Add integration tests for both directions and assert balance changes on both layers. 9. Maintain the bridge procedure in one canonical file and reference it elsewhere rather than duplicating summaries. 10. Revalidate the address and action types against current official Hyperliquid documentation before publication. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (75)

Credential Access

High

Category: Privilege Escalation
Content: `.gitignore` must include: ``` .env .env.local .env.*.local ```
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: `.gitignore` must include: ``` .env .env.local .env.*.local ```
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: `.gitignore` must include: ``` .env .env.local .env.*.local ```
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: `.gitignore` must include: ``` .env .env.local .env.*.local ```
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: `.gitignore` must include: ``` .env .env.local .env.*.local ```
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: `.gitignore` must include: ``` .env .env.local .env.*.local ```
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: `.gitignore` must include: ``` .env .env.local .env.*.local ```
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: `.gitignore` must include: ``` .env .env.local .env.*.local ```
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: `.gitignore` must include: ``` .env .env.local .env.*.local ```
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: `.gitignore` must include: ``` .env .env.local .env.*.local ```
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Anti-Refusal Statement

High

Category: Anti-Refusal
Content: [ ] All unit tests pass locally [ ] Fuzz tests run with at least 10,000 runs (FOUNDRY_FUZZ_RUNS=10000) [ ] Invariant tests find no violations [ ] Contract compiles without warnings [ ] No hardcoded addresses — use constructor params or config files [ ] Deployment script tested locally with `--dry-run` [ ] Contract verified on testnet explorer after deploy
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

External Script Fetching

High

Category: Supply Chain
Content: ```bash # Install Foundry curl -L https://foundry.paradigm.xyz | bash foundryup # Initialize a project
Confidence: 98% confidence
Finding: The command pipes a remotely fetched script directly into bash, which allows arbitrary code execution if the remote server, transport, or install script is compromised. In a security context this is a well-known unsafe installation pattern because users execute unaudited code immediately on their machine.

Chaining Abuse

High

Category: Tool Misuse
Content: ```bash # Install Foundry curl -L https://foundry.paradigm.xyz | bash foundryup # Initialize a project
Confidence: 99% confidence
Finding: The '| bash' construct is the dangerous part of the install command because it chains network retrieval directly into shell execution without review. This reduces user opportunity to inspect the payload and makes compromise of the upstream source immediately exploitable on developer systems.

External Transmission

Medium

Category: Data Exfiltration
Content: **Perp markets** — use asset index from `meta.universe`: ```python meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: **Perp markets** — use asset index from `meta.universe`: ```python meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: **Perp markets** — use asset index from `meta.universe`: ```python meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: **Perp markets** — use asset index from `meta.universe`: ```python meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: **Perp markets** — use asset index from `meta.universe`: ```python meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: **Perp markets** — use asset index from `meta.universe`: ```python meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: **Perp markets** — use asset index from `meta.universe`: ```python meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: **Perp markets** — use asset index from `meta.universe`: ```python meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: **Perp markets** — use asset index from `meta.universe`: ```python meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: **Perp markets** — use asset index from `meta.universe`: ```python meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: **Perp markets** — use asset index from `meta.universe`: ```python meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: **Perp markets** — use asset index from `meta.universe`: ```python meta = requests.post('https://api.hyperliquid.xyz/info', json={'type': 'meta'}).json() # ETH perp is typically at index 1 # BTC perp is typically at index 0
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.