Security audit

Web3 Trader

Security checks for vulnerabilities and agentic risk

Overview

This is a real crypto-trading skill, but it needs Review because it can enable automated trades and has inconsistent disclosure around custody, automatic wallet prompts, approvals, and exposed trading credentials.

Review carefully before installing. Use only test or very small balances at first, treat any agent key as a live trading credential, disable automatic small-trade execution if possible, avoid using a main wallet private key, and revoke token approvals or Hyperliquid agent permissions when finished. Expect wallet addresses, intended trades, preview links, and signatures to be shared with external trading services.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (24)

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The security model claims the hosted swap page has no backend communication or tracking, but the same document says the page is server-generated, hosted, and delivered from a remote domain. This inconsistency can mislead users about privacy and trust boundaries, causing them to interact with remotely controlled content under a false assumption of self-contained behavior.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The behavior section states that a wallet browser may auto-trigger `eth_sendTransaction` after a short countdown, while the changelog later claims this automatic execution was removed. For a trading/signing skill, contradictory guidance about whether transactions can be auto-initiated is high risk because implementers may preserve or reintroduce unsafe auto-signing UX that pressures or surprises users into approving transactions.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The spec explicitly says write operations use 'Agent Wallet mode' and that an 'Agent key [is] stored securely on MCP server (per-user)'. That creates a custodial signing capability on the server side, which directly contradicts the skill's stated '零托管，私钥不离开用户钱包' model and materially expands the attack surface to server compromise, insider misuse, or unauthorized order placement. In a trading skill, this is especially dangerous because the key can be used for irreversible financial actions such as opening leveraged positions, closing positions, or changing leverage.

Intent-Code Divergence

High

Confidence: 93% confidence
Finding: The authentication notes conflict with the documented non-custodial wallet claims, which is a security-significant design inconsistency rather than a mere documentation issue. Users and downstream integrators may trust the tool under a zero-custody assumption while the server actually retains signing authority for write operations, undermining informed consent and increasing the chance of unauthorized or unexpected trades.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill exposes a signed Spot↔Perp transfer capability that moves funds between account classes, which is materially different from simple swap/order placement described in the skill metadata. In an agent-skill context, capability expansion is dangerous because users may trigger balance-moving actions they did not expect from the declared trading scope, increasing the risk of unauthorized or socially engineered fund movement.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: In dapp browsers, the page automatically calls doSwap() after a 2-second delay, which triggers account access and a transaction submission flow without an explicit click from the user at that moment. In a Web3 trading skill, initiating wallet actions automatically is especially dangerous because users may be conditioned to trust quote/review pages, increasing the risk of unintended signing or rushed approval of asset-moving transactions.

Intent-Code Divergence

Medium

Confidence: 99% confidence
Finding: The page states that the transaction will appear in the wallet for review, but the script also auto-starts the execution flow in dapp mode after a delay. This mismatch is a deceptive UX/security pattern because it lowers user caution while programmatically initiating a sensitive wallet action, which is particularly risky in a token swap context where approval or swap signing can immediately move funds.

Context-Inappropriate Capability

Low

Confidence: 96% confidence
Finding: The tool constructs a QR image URL using a third-party service and embeds the generated preview URL as a query parameter, which transmits user-specific trading page links to an unrelated external domain. In a trading skill, preview URLs may expose order details, wallet-related context, or access tokens if present, creating avoidable data leakage and third-party tracking risk.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The endpoint reads HTML from disk and serves it directly with a permissive Content Security Policy that allows inline scripts and unrestricted outbound network connections. If an attacker can influence the generated HTML or any upstream content written to these files, the preview page becomes an active script execution surface that can exfiltrate wallet data, session information, or trigger malicious Web3 interactions from the user's browser.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README promotes autonomous trading after a one-time approval but does not prominently warn that financial trades may be executed automatically and can be irreversible. In a high-risk trading context, lack of explicit user-facing risk disclosure can lead users to authorize behavior they do not fully understand, increasing the chance of unintended losses.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Documenting auto-execution for trades under $100 without an explicit warning means users may not realize some orders can be placed non-interactively once prior authorization exists. In a leveraged trading skill, repeated or manipulated small trades can still accumulate into substantial losses, making this more dangerous than a generic workflow omission.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation keywords are extremely broad and include generic trading terms that can appear in normal conversation. In a high-risk financial skill, overbroad triggering can cause the agent to enter a transactional flow unexpectedly, exposing users to unwanted quote generation, remote calls, or trading prompts without clear intent.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The routing examples map ambiguous natural-language phrases directly to trading modules, including leveraged perpetual actions. In context, this makes accidental invocation more dangerous because the skill covers irreversible or loss-bearing operations, not just harmless information retrieval.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The fallback workflow uploads generated swap pages to a third-party hosting service without clearly warning users that wallet address, trade details, or embedded transaction data may be exposed to an external service. This creates privacy and integrity risks because users may believe the flow remains first-party or local while sensitive trading metadata is being published elsewhere.

Missing User Warnings

High

Confidence: 90% confidence
Finding: The spec exposes tools for market orders, limit orders, closing positions, cancelling orders, setting leverage, and TP/SL placement without any explicit user-facing warning, confirmation requirements, or irreversible-loss guidance in the tool contract. In a financial trading context, especially with leverage and perpetuals, omission of strong safety messaging and confirmation semantics increases the risk of accidental destructive actions, prompt-triggered misuse, and user misunderstanding leading to immediate financial loss.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The page generates a fresh agent wallet and then reveals the raw private key directly in the DOM, making it copyable and visible to any script running in the page, browser extensions, shoulder-surfing, screenshots, or screen-recording tools. In a trading skill context, that agent key can authorize trading actions on the user's linked Hyperliquid account, so accidental exposure can lead to unauthorized order placement or balance movements within the agent's permissions.

Missing User Warnings

Low

Confidence: 78% confidence
Finding: The code automatically transmits a wallet-linked authorization payload and signature to the Hyperliquid API immediately after signing, without an explicit user-facing notice or separate confirmation that signed identity-linked data will be sent off-page. While this is expected for completing agent approval, the lack of disclosure reduces informed consent and can mislead users about what data leaves their browser.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The page initiates a fund-moving transfer after only amount entry and a wallet signature prompt, without a clear in-app confirmation that this is an internal balance transfer rather than a harmless information request. In wallet-based systems, users often do not understand typed-data prompts, so the lack of an explicit pre-sign warning materially increases the chance of accidental authorization of unwanted fund movements.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The script sends the user's wallet address and associated account-state queries to external Hyperliquid API endpoints immediately after wallet connection, without telling the user that their address and portfolio metadata will be shared. While public addresses are not secret, correlating wallet identity with balance/state data can create avoidable privacy leakage and user-tracking risk.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The page sends an ERC-20 approve transaction with MAX_UINT256, granting effectively unlimited spending to APPROVE_TARGET, but the UI only says 'APPROVE <token>' and does not clearly disclose that this is a max approval with ongoing risk. In a Web3 trading skill, this is especially dangerous because a compromised, upgraded, or misconfigured spender contract could drain all approved tokens later, well beyond the amount needed for the current order.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The swap is auto-initiated in dapp mode without a prior explicit warning or affirmative action tied to transaction submission. In the context of a DEX-trading skill that constructs raw transaction parameters, this behavior meaningfully increases the chance of unauthorized or unintended transaction prompts and can facilitate social-engineering-style fund loss.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The quote flow transmits the user's taker wallet address to the third-party 0x API, linking wallet identity with intended trades. In a web3 trading context this can expose sensitive behavioral and financial metadata, enable profiling, and reduce user privacy, especially because wallet addresses are persistent identifiers on public blockchains.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code sends preview URLs to an external QR code provider without any visible disclosure or consent flow. Because this is a financial trading skill, even metadata about when a user created a signing page or which link they received can be sensitive, making undisclosed third-party transmission more serious than in a low-risk context.

Missing User Warnings

Low

Confidence: 79% confidence
Finding: The file explicitly instructs users to provide a private key via the HL_PRIVATE_KEY environment variable for funded tests, but gives no in-file guidance on safely handling that credential. In a trading skill context, encouraging raw private-key use increases the risk of accidental exposure through shell history, CI logs, test runners, or misconfigured environments, which could lead to wallet compromise and fund loss.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/tools/web3-trader.tools.ts:436