Security audit
Security checks for vulnerabilities and agentic risk
This skill is a tightly scoped Hyperliquid trading execution workflow that requires explicit user approval and a trusted signer before any financial action.
Before installing, understand that this skill is intended for real trading actions and should only be used with a reviewed ticket, exact `approve <ticket-id>` confirmation, and a trusted signer or approved API wallet boundary. Do not paste private keys or seed phrases into the agent, and prefer pinned, reviewed versions for any optional SDK or related-skill installation.
The document instructs use of npx skills add ... without pinning an exact package version or integrity source, which can cause execution of whatever package version is current at install time. In a security-sensitive trading skill chain, that creates a supply-chain risk: a compromised or malicious upstream release could be fetched and executed in the user's environment.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
For HTTP-capable harnesses, use the official Info endpoint directly for reads. The equivalent metadata request is:
curl --fail-with-body https://api.hyperliquid.xyz/info \
-H 'Content-Type: application/json' \
--data '{"type":"meta"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
For HTTP-capable harnesses, use the official Info endpoint directly for reads. The equivalent metadata request is:
curl --fail-with-body https://api.hyperliquid.xyz/info \
-H 'Content-Type: application/json' \
--data '{"type":"meta"}'
No suspicious patterns detected.