Security audit

hyperbot-quote

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly documented read-only crypto analytics MCP integration, but users should understand that wallet/query data is sent to external services and outputs may influence financial decisions.

Install only if you are comfortable sending wallet addresses, query parameters, and session/query metadata to the Hyperbot MCP service and related market-data providers. Treat analytics and trading recommendations as informational, verify them independently, and avoid submitting sensitive or personally identifying wallet sets unless you have consent and understand the provider's data handling.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.
md
[中文](SKILL_zh.md) | [English](SKILL.md)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill immediately directs users to an external MCP endpoint but does not warn that prompts, wallet addresses, and trading-query data will be transmitted to a third-party service. In a trading analytics context, wallet addresses and associated query patterns can reveal sensitive financial behavior, creating privacy and surveillance risk even if the service is nominally read-only.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 82% confidence
Finding: The skill instructs agents to send tool-call data to https://mcp.hyperbot.network, which is an external network transmission outside the local trust boundary. In this skill's context, that is expected functionality, but it is still security-relevant because any submitted prompts, identifiers, wallet addresses, and query metadata leave the local environment and may be logged or processed by the remote operator.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
MCP Tool Call Example:

bash
curl 'https://mcp.hyperbot.network/mcp/message?sessionId=sessionId obtained via sse' \ -H 'content-type: application/json' \ --data-raw '{"method":"tools/call","params":{"name":"fetch_leader_board","arguments":{"period":"7d","sort":"pnl"}},"jsonrpc":"2.0","id":1}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: These trader-analysis and batch-query features accept wallet addresses and request detailed historical trading behavior from an external service, yet the documentation provides no warning about privacy implications. Even though blockchain addresses are often public, aggregating, profiling, and transmitting them through a third-party analytics endpoint materially increases privacy exposure and can enable deanonymization or behavioral tracking.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill sends user-supplied wallet addresses and related query data to an external MCP server, but the description does not warn users that this data leaves the local trust boundary. In a finance context, wallet addresses and behavioral queries can be sensitive because they reveal holdings, strategy interests, and analytical targets to a third party.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: The documented usage transmits data to an external network endpoint and includes a session identifier in the request URL. External transmission is expected for an MCP service, but it still expands the attack surface because wallet addresses, queries, and session metadata may be exposed to the remote operator, logs, intermediaries, or reused if session handling is weak.
Content: Scanner excerpt · SKILL_zh.md (reported line 40)May include surrounding context.
MCP 工具调用示例:

bash
curl 'https://mcp.hyperbot.network/mcp/message?sessionId=通过 sse 获得的 sessionId' \ -H 'content-type: application/json' \ --data-raw '{"method":"tools/call","params":{"name":"fetch_leader_board","arguments":{"period":"7d","sort":"pnl"}},"jsonrpc":"2.0","id":1}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill provides analytics and explicit trading suggestions without a caution that outputs may influence real financial decisions and may be inaccurate, delayed, or unsuitable. In a trading context, omission of this warning increases the risk that users or agents over-trust the output and take harmful actions based on incomplete or misleading signals.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document instructs users to query wallet addresses, trade history, and trader statistics without any privacy, consent, retention, or data-minimization guidance. In an agent setting, this can normalize collection and transmission of potentially sensitive financial behavioral data to third-party services, increasing privacy and compliance risk even if the data is blockchain-derived.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The resource list exposes external endpoints for trader statistics, whale positions, and market data but does not warn that user queries may be sent to third-party domains. In agent workflows, this omission can cause silent data disclosure to external services and obscure trust boundaries, especially when wallet addresses or account sets are included in requests.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation's Example 4 instructs callers to use get_all_mids(), but no such tool is defined anywhere in the documented Tools section. This is an intent/documentation divergence because the example actively describes a capability path that the rest of the skill documentation does not expose.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document's Tools section enumerates available MCP tools, but no get_all_mids tool is defined anywhere in that list. Presenting it as a callable example actively conflicts with the documented interface and can mislead users about the skill's actual capabilities.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.