HyperGrok Hyperliquid Setup

• Outcome: Pass
• Latest audit: Oct 13, 2026 · 10:16 AM UTC
• Version: 1.6.1

Overview

This skill is a disclosed Hyperliquid setup guide whose sensitive actions are tied to user-directed trading setup, with caution needed around API wallet secret handling.

Install only if you intend to set up Hyperliquid tooling. Prefer the secure secret store over the local key-file fallback, keep mainnet deliberate, never provide a seed phrase or main-wallet private key, and revoke or rotate the API wallet promptly if the machine or key may be exposed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

bash

for base in https://api.hyperliquid.xyz https://api.hyperliquid-testnet.xyz; do
  printf '%s -> ' "$base"
  curl -sS -m 10 -X POST "$base/info" -H 'Content-Type: application/json' \
    -d '{"type":"allMids"}' | jq -r 'if type=="object" then "ok, \(length) mids, BTC \(.BTC)" else "unexpected: \(.)" end'
done

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

Although the skill explicitly forbids storing secrets under /workspace, it still permits a fallback of persisting the private API wallet key in ~/.hyperliquid/api-wallet.key. Any long-lived plaintext secret on disk increases exposure to local compromise, malware, backup leakage, or other bots/processes running under the same user context; the skill itself notes that anything on the shared computer is readable by every Bot.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

### 4.2 The user provides the key through the secure secret store

Grok Bot has a secure secret card for exactly this. Ask the user to add a secret named `HYPERLIQUID_PRIVATE_KEY` with the API wallet's private key. Never ask them to paste it in chat and never write it to a file under `/workspace`.

If the desk's Grok Bot setup exposes secrets to the computer as environment variables, scripts read `HYPERLIQUID_PRIVATE_KEY` from the environment. If it does not, the fallback is a file the **user** creates while in control of the computer:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

If the desk's Grok Bot setup exposes secrets to the computer as environment variables, scripts read HYPERLIQUID_PRIVATE_KEY from the environment. If it does not, the fallback is a file the user creates while in control of the computer:

bash

mkdir -p ~/.hyperliquid && chmod 700 ~/.hyperliquid
# the user pastes the key into this file themselves, then:
chmod 600 ~/.hyperliquid/api-wallet.key

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

bash

mkdir -p ~/.hyperliquid && chmod 700 ~/.hyperliquid
# the user pastes the key into this file themselves, then:
chmod 600 ~/.hyperliquid/api-wallet.key

Every signing snippet on the desk uses the same loader, which reads the environment first, then that file, and never prints the key: