Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed, read-only Hyperliquid monitoring helper with clear limits against trading actions or secret handling.
Install this only if you are comfortable giving the agent a public Hyperliquid account or subaccount address to monitor. Do not provide private keys, seed phrases, or signer secrets; use pinned, reviewed versions for any optional SDK or related-skill installs.
Referenced artifact was not completely inspected
5. Normalize funding by its stated interval. Use `node scripts/funding.mjs --help` for arithmetic. Preserve funding signs from the account's perspective.
The document instructs use of npx skills add ... without pinning an exact package version or immutable source. That can cause the agent or user to fetch and execute whatever package version is current at install time, expanding the supply-chain attack surface if the package is compromised, republished, or unexpectedly changed.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
For HTTP-capable harnesses, use the official Info endpoint directly for reads. The equivalent metadata request is:
curl --fail-with-body https://api.hyperliquid.xyz/info \
-H 'Content-Type: application/json' \
--data '{"type":"meta"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
For HTTP-capable harnesses, use the official Info endpoint directly for reads. The equivalent metadata request is:
curl --fail-with-body https://api.hyperliquid.xyz/info \
-H 'Content-Type: application/json' \
--data '{"type":"meta"}'
No suspicious patterns detected.