Security audit

Byreal Perps CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Hyperliquid trading CLI wrapper, but it gives agents access to high-impact live trading actions with weak safety scoping and a mutable global install path.

Review this skill before installing. Use testnet first, avoid broad delegation such as 'manage my trades,' require the agent to restate order side, coin, size, price, leverage, and account before any write action, and consider pinning/verifying the CLI package rather than installing or updating the latest global version.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:8
Finding: Unpinned Global Installation of a Security-Sensitive Third-Party Package
Content: View full analysis
Remediation: View remediation
``` 2. Record and verify the expected package integrity hash or provide signed release artifacts. Document the exact verification command users must run before installation. 3. Replace automatic “latest version” updates with an explicit update policy requiring: - Review of release notes and source changes. - Verification of package signatures or checksums. - Approval of a specific version before deployment. 4. Prefer a project-local installation with a committed lockfile over global installation where operationally feasible. Invoke the pinned binary through a controlled package script or equivalent mechanism. 5. Protect the release supply chain with npm provenance, publisher-account multi-factor authentication, restricted publishing credentials, protected CI environments, and reproducible builds. 6. Publish the CLI source and update implementation for independent review, particularly the code responsible for credential storage, transaction signing, endpoint selection, and self-updates. 7. Run the CLI under a dedicated, least-privileged operating-system account and restrict access to unrelated files and credentials. 8. Apply transaction-level safeguards such as restricted agent-wallet permissions, spending or withdrawal limitations where supported, testnet validation, and explicit confirmation for high-impact trading operations. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation exposes destructive commands such as market orders, leverage changes, cancel-all, and close-all without prominent warnings about irreversible financial impact or the possibility of real-loss execution. In a leveraged perpetuals context, omission of explicit safety gates materially increases the chance of accidental liquidation, unwanted fills, or mass position/order closure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill description is broad enough to trigger on generic terms like 'market signals' or 'technical analysis,' which can cause the agent to invoke a live-trading skill in contexts that may only require informational analysis. In a financial trading skill, accidental activation is risky because nearby documented commands include account-changing and order-executing actions with real monetary consequences.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
If a command returns a connection error: 1. The CLI will retry via HTTP API automatically; if it still fails, the issue is likely network connectivity or Hyperliquid API downtime. 2. Check network connectivity: `curl -s https://api.hyperliquid.xyz/info -X POST -H 'Content-Type: application/json' -d '{"type":"meta"}'` 3. For testnet, check: `curl -s https://api.hyperliquid-testnet.xyz/info -X POST -H 'Content-Type: application/json' -d '{"type":"meta"}'` 4. If HTTP API also fails, the Hyperliquid service may be temporarily unavailable — retry after a short wait.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
If a command returns a connection error: 1. The CLI will retry via HTTP API automatically; if it still fails, the issue is likely network connectivity or Hyperliquid API downtime. 2. Check network connectivity: `curl -s https://api.hyperliquid.xyz/info -X POST -H 'Content-Type: application/json' -d '{"type":"meta"}'` 3. For testnet, check: `curl -s https://api.hyperliquid-testnet.xyz/info -X POST -H 'Content-Type: application/json' -d '{"type":"meta"}'` 4. If HTTP API also fails, the Hyperliquid service may be temporarily unavailable — retry after a short wait.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
If a command returns a connection error: 1. The CLI will retry via HTTP API automatically; if it still fails, the issue is likely network connectivity or Hyperliquid API downtime. 2. Check network connectivity: `curl -s https://api.hyperliquid.xyz/info -X POST -H 'Content-Type: application/json' -d '{"type":"meta"}'` 3. For testnet, check: `curl -s https://api.hyperliquid-testnet.xyz/info -X POST -H 'Content-Type: application/json' -d '{"type":"meta"}'` 4. If HTTP API also fails, the Hyperliquid service may be temporarily unavailable — retry after a short wait. ## Hard Constraints

Static analysis

No suspicious patterns detected.