Vincent - Hyperliquid

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:03 PM UTC
• Version: 1.0.70

Overview

The skill is openly for agent-driven HyperLiquid trading, but it repeatedly runs an unpinned latest npm CLI for real fund movements and automated trading actions.

Install only if you trust Vincent, heyvincent.ai, and the currently published `@vincentai/cli` package. Prefer a pinned, reviewed CLI version, run it in a sandbox with only the needed wallet credential access, keep wallet limits low, require human approval for sensitive actions, and test with small amounts before allowing withdrawals, trades, cancel-all actions, or automated rules.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47

Finding

Mutable npm Package Is Downloaded and Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:47
Vulnerability Type: Supply-chain risk from an unpinned third-party dependency
Risk Level: Medium

Vulnerable code snippet:

bash

npx @vincentai/cli@latest secret list --type HYPERLIQUID_WALLET

The same mutable @latest package reference is used throughout the documented wallet, trading, withdrawal, transfer, and trading-engine workflows, including SKILL.md:55, 73, 90-93, 112, 138, 146, 155-165, 190-216, 228-268, 296, and 305-340.

Technical Analysis

The skill repeatedly directs the agent to execute @vincentai/cli through npx using the mutable @latest distribution tag. npx can download and immediately execute the package version currently associated with that tag. Consequently, the effective executable code can change after the skill has been reviewed.

If the npm publisher account, package release process, package dependencies, or registry-delivered artifact is compromised, an attacker can publish altered code under latest. The next documented invocation would execute that code with the permissions of the agent process.

This risk is especially significant because the CLI resolves wallet API credentials and supports financially sensitive operations, including trades, USDC withdrawals, internal transfers, and automated trading rules. Although SKILL.md:11-12 declares access to the wallet-specific credential locations rather than unrelated credential stores, malicious dependency code would run locally and would not necessarily remain within that intended least-privilege boundary.

Attack Path

1. An attacker compromises the npm publisher account, release pipeline, a transitive dependency, or another component used to publish @vincentai/cli.
2. The attacker publishes a malicious package version and assigns it to the latest distribution tag.
3. An agent follows the skill documentation and invokes an `npx @vincen ...[truncated 1411 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace every @latest reference with an exact, reviewed package version, for example @vincentai/cli@X.Y.Z.
2. Install dependencies in a controlled setup phase using a committed lockfile rather than downloading executable code during each wallet operation.
3. Enforce package integrity verification through lockfile integrity hashes, a trusted internal registry, or an equivalent artifact-verification mechanism.
4. Review the pinned package and its transitive dependency tree before deployment.
5. Enable npm provenance verification and require protected, strongly authenticated package publication.
6. Run the CLI in a sandbox with access limited to the required agentwallet credential, necessary temporary storage, and approved network destinations.
7. Ensure wallet API tokens have narrowly scoped permissions, low transaction limits, withdrawal restrictions, and human approval requirements for sensitive operations.
8. Monitor package-version changes and require a fresh security review before updating the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (38)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill repeatedly instructs agents to execute npx @vincentai/cli@latest, which fetches and runs whatever code is currently published under that package name at runtime rather than a vetted immutable version. If the package, maintainer account, or dependency chain is compromised, an agent could execute attacker-controlled code with access to wallet identifiers, local files, or other agent privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using npx @vincentai/cli@latest causes remote code to be downloaded and executed on demand, making the trust boundary depend on the current state of the npm registry and upstream maintainers. In a wallet/trading skill, that is especially dangerous because the invoked CLI mediates sensitive financial actions and credential workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This command pattern executes an unpinned npm package at runtime, exposing the agent to supply-chain compromise and unexpected behavior changes. Because the command can retrieve wallet state and operate on a live trading account, compromise of the package could directly affect funds or leak sensitive account metadata.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

An unpinned npx invocation means the code run by the agent is not stable or reviewable over time and may change without notice. In the context of internal transfers between sub-accounts, malicious or compromised package updates could alter transfer behavior or exfiltrate identifiers and responses.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The documented command depends on downloading the latest published CLI package at execution time, which is a classic software supply-chain risk. Since the skill is designed for automated agents handling wallets, even a brief compromise of the package could translate into unauthorized actions or data theft.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill documents withdrawals and live trading flows but does not include a strong, explicit warning that these actions can cause irreversible asset transfers and real financial loss. In an agent-executable skill, missing safety warnings increase the chance of unintended fund movement or risky autonomous trading by users who treat the examples as routine operations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Executing npx @vincentai/cli@latest for withdrawal operations gives mutable third-party code direct influence over asset movement workflows. A compromised release could change destination handling, alter prompts, or abuse the agent runtime during execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Even read-oriented commands like market queries become a supply-chain execution risk when invoked through npx ...@latest. The direct impact is somewhat lower than withdrawal/trade commands, but compromised code could still abuse the agent environment or mislead later trading decisions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This command fetches and runs the latest available package version at runtime, allowing upstream package changes to affect agent behavior unexpectedly. Although the immediate function is order book retrieval, the package itself may have broader runtime permissions and can still execute arbitrary logic.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs market trade execution through a mutable npm artifact, which combines supply-chain risk with direct financial action. If an attacker gains control of the package or a dependency, they could tamper with trade parameters, alter outputs, or execute arbitrary code within the agent environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This trading command uses the same unpinned runtime package execution model, leaving live position-closing logic dependent on whatever npm serves at that moment. The risk is amplified because a compromised package could interfere with reduce-only semantics or mis-handle order parameters during execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Using npx @vincentai/cli@latest for limit-order placement exposes the agent to arbitrary code execution from the package registry and to silent functional drift over time. In a live trading system, that can lead to incorrect orders, data leakage, or abuse of the agent host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

Even open-order inspection is performed through an unpinned package resolved at execution time, so the agent is still exposed to supply-chain compromise. The action itself is lower risk than trading, but the executed code may still access local context or alter subsequent decision-making.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This read/filter command still runs mutable remote code from npm each time it is invoked. A compromised release could spoof outputs, harvest wallet identifiers, or prepare for later financial misuse by the agent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

Trade history retrieval via npx ...@latest is another supply-chain trust issue: the command being run is not fixed and could change or be malicious. While the primary operation is read-only, the package can still execute arbitrary code within the agent runtime.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

Because the package version is not pinned, execution depends on the current npm state rather than a reviewed artifact. This creates a path for malicious updates or breaking changes to affect the agent even during simple history queries.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Cancel-order functionality is still mediated by unpinned remote code, so a compromised package could alter which orders are canceled, misreport success, or run arbitrary logic. Since order cancellation can materially affect trading exposure, this is more than a documentation hygiene issue.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Cancel-all operations through npx @latest create both supply-chain and operational risk because the command can materially change market exposure. If the package or dependencies are compromised, an attacker could disrupt strategies, manipulate orders, or exploit the agent host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This variant of cancel-all has the same unpinned execution risk and can materially affect active positions and risk management. The package's mutable nature makes the skill unsafe for deterministic automated operation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Trading-engine rule creation is documented through an unpinned CLI package that is fetched and executed on demand. Because these rules can later trigger automated sales without LLM involvement, compromise of the package could create, alter, or misconfigure protective and exit logic in ways that directly affect funds.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Take-profit rule creation via npx ...@latest inherits the same supply-chain risk while controlling future automated execution. In a financial automation context, mutable tooling is particularly dangerous because errors or compromise may only surface when the rule fires under market conditions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Trailing-stop rule creation depends on executing the latest npm package at runtime, so any malicious or accidental upstream change can directly alter automated risk controls. Given that trailing logic is sensitive to price movement, subtle tampering could materially impact exits and losses.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

Listing rules is lower risk functionally, but the same unpinned package execution model still exposes the agent to arbitrary code execution and output spoofing. This can undermine operator understanding of active protections and positions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Updating an existing trading rule via a mutable package retrieved at runtime can silently change future automated behavior governing exits or stop conditions. In a trading environment, compromised tooling here can directly increase losses or disable protections.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Deleting a rule through unpinned runtime code can remove automated protections if the package is compromised or behaves unexpectedly. That creates direct financial risk because safety controls may be disabled without the user realizing it.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.