Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Hyperliquid integration engineering guide that emphasizes read-only setup, explicit authorization for writes, and keeping signing secrets outside the agent.
Before installing, treat it as financial-integration guidance: keep private keys out of the agent and repository, review any optional npx installation before running it, and require explicit user approval for any testnet write or account-affecting action.
The document instructs use of npx skills add ... without pinning an exact package version or otherwise constraining what code will be fetched and executed. Because npx resolves and runs remote package content at install time, this creates a supply-chain risk where a compromised latest release, dependency, or namespace takeover could execute unexpected code in the operator environment.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
For HTTP-capable harnesses, use the official Info endpoint directly for reads. The equivalent metadata request is:
curl --fail-with-body https://api.hyperliquid.xyz/info \
-H 'Content-Type: application/json' \
--data '{"type":"meta"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
For HTTP-capable harnesses, use the official Info endpoint directly for reads. The equivalent metadata request is:
curl --fail-with-body https://api.hyperliquid.xyz/info \
-H 'Content-Type: application/json' \
--data '{"type":"meta"}'
No suspicious patterns detected.