Security audit

Hyperliquid Wallet Audit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a bounded, read-only wallet-audit helper that uses public Hyperliquid data and writes local evidence files, with no signer, trading action, credential access, or background persistence found.

Install only if you are comfortable sending the chosen public wallet address and time window to Hyperliquid's Info API and storing raw wallet-activity evidence locally. Treat generated capture and evidence files as sensitive financial metadata when sharing them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (16)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
node scripts/wallet-audit.mjs example --out ./wallet-audit-example --json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.
md
node scripts/wallet-audit.mjs example --out ./wallet-audit-example --json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
node scripts/wallet-audit.mjs example --out ./wallet-audit-example --json

Unbounded Resource Access

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
1. Resolve account address, network, time window and output directory from the request or existing context. Ask only for a missing input that changes correctness. Read [data scope and API limits](references/data-contract.md) when choosing the window or interpreting coverage. 2. Capture sequential public `userRole`, `userAbstraction`, `clearinghouseState`, `spotClearinghouseState`, `frontendOpenOrders`, `userFillsByTime` and `userFunding` reads. The helper accepts only the two official network endpoints and the named read types. Page limits, timeout and response-byte limits bound the work. 3. Verify the request/response SHA256 manifest and deduplicate identical activity. Malformed numbers, unsafe identities, conflicting duplicates, wrong account/network and out-of-window records fail closed. An HTTP or network failure is retained as an explicit missing read. Do not treat it as zero activity or retry indefinitely. 4. Analyze default-perp closed PnL, signed fees/rebates and funding, maker/taker notional shares and per-market fee concentration. Fees retain their token denomination. `builderFee` is already included in `fee`; do not add it again. Non-USDC fees without valuation keep net USDC unavailable. 5. Separate current default-perp positions and spot balances from historical activity. Under unified or portfolio-margin accounts, spot balances are the trading-balance source. Do not add them to perpetual `accountValue`. Other DEX positions are outside this helper's exposure scope. 6. Return the observed outcome, largest supported cost or exposure finding, coverage status and files. State that API exhaustion does not prove a complete window. Report initial inventory from the first observed fill as an observation, not the window's opening position.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The fixture contains granular wallet activity, balances, open orders, fills, and funding records tied to a wallet address, which are sensitive financial data even if the address is public on-chain. Shipping this as an example without an explicit warning or minimization increases the chance that real captures are copied, shared, or logged in ways users may not expect.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · examples/capture.json (reported line 15)May include surrounding context.
json
# Public read contract Verified against the official Info documentation on 2026-10-09. Mainnet endpoint: `https://api.hyperliquid.xyz/info`. Testnet: `https://api.hyperliquid-testnet.xyz/info`. Every request is POST with `Content-Type: application/json`. No signing or authentication is used. Query the account being examined, not its API-agent address. The five snapshot request bodies are:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · examples/capture.json (reported line 28)May include surrounding context.
json
# Public read contract Verified against the official Info documentation on 2026-10-09. Mainnet endpoint: `https://api.hyperliquid.xyz/info`. Testnet: `https://api.hyperliquid-testnet.xyz/info`. Every request is POST with `Content-Type: application/json`. No signing or authentication is used. Query the account being examined, not its API-agent address. The five snapshot request bodies are:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · examples/capture.json (reported line 41)May include surrounding context.
json
# Public read contract Verified against the official Info documentation on 2026-10-09. Mainnet endpoint: `https://api.hyperliquid.xyz/info`. Testnet: `https://api.hyperliquid-testnet.xyz/info`. Every request is POST with `Content-Type: application/json`. No signing or authentication is used. Query the account being examined, not its API-agent address. The five snapshot request bodies are:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · examples/capture.json (reported line 54)May include surrounding context.
json
# Public read contract Verified against the official Info documentation on 2026-10-09. Mainnet endpoint: `https://api.hyperliquid.xyz/info`. Testnet: `https://api.hyperliquid-testnet.xyz/info`. Every request is POST with `Content-Type: application/json`. No signing or authentication is used. Query the account being examined, not its API-agent address. The five snapshot request bodies are:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · examples/capture.json (reported line 67)May include surrounding context.
json
# Public read contract Verified against the official Info documentation on 2026-10-09. Mainnet endpoint: `https://api.hyperliquid.xyz/info`. Testnet: `https://api.hyperliquid-testnet.xyz/info`. Every request is POST with `Content-Type: application/json`. No signing or authentication is used. Query the account being examined, not its API-agent address. The five snapshot request bodies are:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · examples/capture.json (reported line 80)May include surrounding context.
json
# Public read contract Verified against the official Info documentation on 2026-10-09. Mainnet endpoint: `https://api.hyperliquid.xyz/info`. Testnet: `https://api.hyperliquid-testnet.xyz/info`. Every request is POST with `Content-Type: application/json`. No signing or authentication is used. Query the account being examined, not its API-agent address. The five snapshot request bodies are:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · examples/capture.json (reported line 93)May include surrounding context.
json
# Public read contract Verified against the official Info documentation on 2026-10-09. Mainnet endpoint: `https://api.hyperliquid.xyz/info`. Testnet: `https://api.hyperliquid-testnet.xyz/info`. Every request is POST with `Content-Type: application/json`. No signing or authentication is used. Query the account being examined, not its API-agent address. The five snapshot request bodies are:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/data-contract.md (reported line 3)May include surrounding context.
md
# Public read contract Verified against the official Info documentation on 2026-10-09. Mainnet endpoint: `https://api.hyperliquid.xyz/info`. Testnet: `https://api.hyperliquid-testnet.xyz/info`. Every request is POST with `Content-Type: application/json`. No signing or authentication is used. Query the account being examined, not its API-agent address. The five snapshot request bodies are:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/audit-engine.mjs (reported line 6)May include surrounding context.
js
# Public read contract Verified against the official Info documentation on 2026-10-09. Mainnet endpoint: `https://api.hyperliquid.xyz/info`. Testnet: `https://api.hyperliquid-testnet.xyz/info`. Every request is POST with `Content-Type: application/json`. No signing or authentication is used. Query the account being examined, not its API-agent address. The five snapshot request bodies are:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/data-contract.md (reported line 3)May include surrounding context.
md
# Public read contract Verified against the official Info documentation on 2026-10-09. Mainnet endpoint: `https://api.hyperliquid.xyz/info`. Testnet: `https://api.hyperliquid-testnet.xyz/info`. Every request is POST with `Content-Type: application/json`. No signing or authentication is used. Query the account being examined, not its API-agent address. The five snapshot request bodies are:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/audit-engine.mjs (reported line 6)May include surrounding context.
js
# Public read contract Verified against the official Info documentation on 2026-10-09. Mainnet endpoint: `https://api.hyperliquid.xyz/info`. Testnet: `https://api.hyperliquid-testnet.xyz/info`. Every request is POST with `Content-Type: application/json`. No signing or authentication is used. Query the account being examined, not its API-agent address. The five snapshot request bodies are:

Static analysis

No suspicious patterns detected.