Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Hyperliquid setup helper that performs public market reads and explicitly avoids wallet secrets or trading authority during setup.
Install this only if you want an agent to check Hyperliquid public market data and tool readiness. Treat any optional `npx skills add` command as a separate install decision, and do not provide private keys or approve trading through this setup skill; account or execution workflows should require a public address or a separately trusted signer with explicit authorization.
The skill instructs the agent to perform live network reads and HTTP/Node-based actions, but it does not declare an explicit tool scope such as allowed tools or permissions. That creates an authorization ambiguity where a harness may expose broader network or execution capability than intended, increasing the chance of unintended outbound access during setup or troubleshooting flows.
The description is broad enough to trigger on general installation, troubleshooting, missing-data diagnosis, monitoring, planning, or execution availability questions. In practice, that can cause the skill to activate in more contexts than necessary and initiate network access or shell-based probing when the user only asked a high-level question, expanding the attack surface and risking overreach by the agent.
The documentation instructs use of npx skills add ... without pinning an exact package version, which can cause execution of whatever package version is current at install time. If the package or a dependency is compromised upstream, users may run unexpected code during installation, creating a supply-chain risk in a setup workflow that is specifically about installing capabilities.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
For HTTP-capable harnesses, use the official Info endpoint directly for reads. The equivalent metadata request is:
curl --fail-with-body https://api.hyperliquid.xyz/info \
-H 'Content-Type: application/json' \
--data '{"type":"meta"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import { realpathSync } from "node:fs";
import { pathToFileURL } from "node:url";
const endpoints = { mainnet: "https://api.hyperliquid.xyz/info", testnet: "https://api.hyperliquid-testnet.xyz/info" };
function number(value, name, positive = false, allowNegative = false) {
if (typeof value !== "string" || !/^[-]?(?:0|[1-9]\d*)(?:\.\d+)?(?:e[+-]?\d+)?$/i.test(value) || !Number.isFinite(Number(value)) || (positive && Number(value) <= 0) || (!allowNegative && Number(value) < 0)) throw new Error(`Invalid ${name}`);
return Number(value);
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import { realpathSync } from "node:fs";
import { pathToFileURL } from "node:url";
const endpoints = { mainnet: "https://api.hyperliquid.xyz/info", testnet: "https://api.hyperliquid-testnet.xyz/info" };
function number(value, name, positive = false, allowNegative = false) {
if (typeof value !== "string" || !/^[-]?(?:0|[1-9]\d*)(?:\.\d+)?(?:e[+-]?\d+)?$/i.test(value) || !Number.isFinite(Number(value)) || (positive && Number(value) <= 0) || (!allowNegative && Number(value) < 0)) throw new Error(`Invalid ${name}`);
return Number(value);
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import { realpathSync } from "node:fs";
import { pathToFileURL } from "node:url";
const endpoints = { mainnet: "https://api.hyperliquid.xyz/info", testnet: "https://api.hyperliquid-testnet.xyz/info" };
function number(value, name, positive = false, allowNegative = false) {
if (typeof value !== "string" || !/^[-]?(?:0|[1-9]\d*)(?:\.\d+)?(?:e[+-]?\d+)?$/i.test(value) || !Number.isFinite(Number(value)) || (positive && Number(value) <= 0) || (!allowNegative && Number(value) < 0)) throw new Error(`Invalid ${name}`);
return Number(value);
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import { realpathSync } from "node:fs";
import { pathToFileURL } from "node:url";
const endpoints = { mainnet: "https://api.hyperliquid.xyz/info", testnet: "https://api.hyperliquid-testnet.xyz/info" };
function number(value, name, positive = false, allowNegative = false) {
if (typeof value !== "string" || !/^[-]?(?:0|[1-9]\d*)(?:\.\d+)?(?:e[+-]?\d+)?$/i.test(value) || !Number.isFinite(Number(value)) || (positive && Number(value) <= 0) || (!allowNegative && Number(value) < 0)) throw new Error(`Invalid ${name}`);
return Number(value);
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import { realpathSync } from "node:fs";
import { pathToFileURL } from "node:url";
const endpoints = { mainnet: "https://api.hyperliquid.xyz/info", testnet: "https://api.hyperliquid-testnet.xyz/info" };
function number(value, name, positive = false, allowNegative = false) {
if (typeof value !== "string" || !/^[-]?(?:0|[1-9]\d*)(?:\.\d+)?(?:e[+-]?\d+)?$/i.test(value) || !Number.isFinite(Number(value)) || (positive && Number(value) <= 0) || (!allowNegative && Number(value) < 0)) throw new Error(`Invalid ${name}`);
return Number(value);
No suspicious patterns detected.