Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Hyperliquid trade-planning aid that produces unsigned tickets and explicitly avoids signing, submitting, or handling private keys.
Before using this skill, be aware that it may use your public Hyperliquid account or subaccount address to read positions, orders, balances, fees, and market data for planning. Do not provide private keys or signer secrets to this skill, and review any optional `npx skills add` installation command before running it because it is not version-pinned.
Referenced artifact was not completely inspected
ces.md); mark inapplicable entry-sizing fields as such with a reason. Use `node scripts/risk.mjs --help` for deterministic arithmetic. The stop fill must includ
The documentation instructs use of npx skills add ... without pinning an exact package version or integrity, which can cause installation of whatever version is current at execution time. If the package or one of its dependencies is compromised, users may run attacker-controlled code during install, and the skill context makes this more concerning because it relates to crypto/DeFi workflows where downstream compromise could affect sensitive operational environments.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
For HTTP-capable harnesses, use the official Info endpoint directly for reads. The equivalent metadata request is:
curl --fail-with-body https://api.hyperliquid.xyz/info \
-H 'Content-Type: application/json' \
--data '{"type":"meta"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
For HTTP-capable harnesses, use the official Info endpoint directly for reads. The equivalent metadata request is:
curl --fail-with-body https://api.hyperliquid.xyz/info \
-H 'Content-Type: application/json' \
--data '{"type":"meta"}'
No suspicious patterns detected.