Security audit

Hypii Hyperliquid Trader

Security checks across malware telemetry and agentic risk

Overview

This crypto trading skill can place live orders and ships exposed trading-key material in runnable scripts, so it needs review before use.

Do not install this as-is for real funds. First remove the embedded private keys, rotate any exposed account keys, delete or isolate live-trade demo scripts, require dry-run/testnet by default, add a mandatory order preview and explicit confirmation for every live trade, fix trade side validation, and clearly label or replace the randomized AI-signal feature.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (35)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill requests or implies access to sensitive capabilities (environment variables and network access) but does not explicitly declare permissions. In a trading skill that handles private keys and payment credentials, this reduces transparency and prevents hosts or users from accurately assessing the security boundary before use.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The documented behavior does not match the observed behavior: undeclared billing flows, inconsistent pricing, and misleading 'AI signals' create a trust and consent problem. In a financial trading skill, hidden payment paths or deceptive functionality can cause unauthorized charges, unsafe trading decisions, and user reliance on features that are not what they claim to be.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: A private trading key is hardcoded directly in the source, which exposes full account-signing capability to anyone who can read the file, logs, repository history, or packaged skill contents. In a live trading agent context, this is especially dangerous because the key can be reused immediately to place unauthorized trades, manipulate positions, or drain account value.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The file contains a plaintext hardcoded private key that is directly used to instantiate a trading client capable of placing real orders. Anyone with access to the code, logs, repository history, or packaged skill can recover the key and take full control of the associated trading account, potentially draining funds or opening malicious leveraged positions.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The file directly executes a live BTC-PERP order despite the skill being marketed as a broader automated trading agent with DCA, grid, AI signals, and portfolio management features. This mismatch is dangerous because users may believe they are invoking analysis or strategy logic when the script actually places a real order immediately, increasing the risk of unintended financial loss.

Intent-Code Divergence

Low

Confidence: 80% confidence
Finding: The code describes the computed value as a 'valid price' but actually raises the buy limit price by 5%, which can cause the order to execute at materially worse prices than the current market. In a trading context, misleading pricing logic and comments can hide execution risk and make reviewers underestimate the real slippage exposure.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The skill advertises AI trading signals, but the implementation generates random market direction, confidence, and indicators while presenting them as reasoned analysis. In a trading agent context, users may act on these outputs as if they were legitimate financial signals, causing direct monetary loss through deceptive or unreliable automated decisions.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The comments acknowledge the function is a placeholder, but the returned values are formatted as authentic trend analysis with technical indicators and confidence scores. This mismatch can mislead integrators or end users into trusting fabricated analytics, especially because the surrounding product description emphasizes automated trading and AI-driven execution.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: In dev mode, the billing function returns `paid: true` even though no payment is processed. In a trading skill with paid strategy execution and automated trading, this can completely bypass monetization and may also cause downstream logic to unlock premium or risky actions under the false assumption that billing succeeded.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill is marketed as micropayment-based, but the implementation silently bypasses real payment enforcement whenever no API key is configured. Because this is a trading agent that can execute premium strategies and automated actions, the mismatch between advertised billing and actual enforcement creates a direct access-control and business-logic weakness.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The script labels itself as 'Test Mode' and a 'Trade Simulation', but it creates a real authenticated Hyperliquid client using a hardcoded private key and performs live account queries. This mismatch is dangerous because users may run it believing it is harmless, while it actually accesses a real wallet and leaks operational/account context through console output.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The file is a narrowly scoped live-trading script that immediately performs a BTC-PERP order rather than implementing the broader, user-driven trading-agent capabilities described in the manifest. In a paid trading skill context, this mismatch is dangerous because users may expect analysis or strategy selection but instead get direct market execution, increasing the chance of unauthorized or surprising trades.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: A live private trading key is hardcoded directly in source and then used to initialize the exchange SDK. Anyone with access to the file, logs, repository history, or package contents can reuse that key to place trades, drain funds, or otherwise take over the associated trading account.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The script submits a real order automatically during execution with no payment gating, no user confirmation, and no runtime selection of strategy or risk parameters. In a trading skill, automatic irreversible financial actions are especially dangerous because simply running the code can trigger unexpected market exposure and losses.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: A real private trading key is embedded directly in the source and then used to initialize a live Hyperliquid client capable of placing orders. Anyone with access to the code can reuse that key to control the account, place trades, drain funds, or manipulate positions, making this far more dangerous in a live trading skill than in a mock/demo context.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The script always places a live BTC-PERP buy order with fixed parameters when run, regardless of user intent, strategy selection, or risk checks. In a trading-agent skill, this is especially dangerous because users expect controlled, strategy-driven automation rather than unconditional execution that can create unauthorized market exposure and financial loss.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The changelog advertises automated trade execution and micropayment-backed strategy execution without any explicit warning that user funds can be committed, positions opened, or losses incurred. In a trading skill, omitting clear financial-risk and order-placement disclosures can mislead users about the consequences of invoking these capabilities, increasing the chance of unintended trades or unexpected charges.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation explicitly states that setting `SKILLPAY_API_KEY` enables real billing, automatic payment processing, and revenue collection, but it does not include a prominent user-facing warning about financial charges, consent requirements, or safeguards before automated trading-related actions incur costs. In a trading skill context, unclear charge disclosure increases the risk of unexpected monetary loss and unauthorized or poorly understood paid operations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation instructs operators to set an `X402_PRIVATE_KEY` environment variable but does not include any warning about treating it as a secret, avoiding logging it, keeping it out of source control, or using a least-privilege wallet. In a trading and payment-processing skill, compromise of this key could enable unauthorized payment actions or theft of funds, and operators may copy insecure examples directly into shells, deployment configs, or shared `.env` files.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The code consumes a sensitive credential inline with no secure handling boundary, no disclosure to the operator, and no indication of least-privilege controls. This increases the likelihood of accidental exposure through code sharing, debugging, reuse, or downstream automation, and in this case the credential authorizes real trading actions.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The script places a real IOC order directly after fetching price data, with no interactive confirmation, simulation mode, safety interlock, or second-factor approval before an irreversible market action. In a trading skill, this context makes the issue more dangerous because execution can cause immediate financial loss from mistakes, prompt injection chains, misconfiguration, or unauthorized invocation.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The code not only embeds a sensitive private key but also uses it in a script that executes a real trade, while providing no meaningful credential safety controls, secret redaction, or secure handling flow. In a trading skill, this is especially dangerous because exposure of signing credentials enables unauthorized transactions with direct financial consequences.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The script calls executeFinalTrade() on load, causing a real trade to be submitted automatically without interactive confirmation, environment gating, or a dry-run default. In a skill for automated crypto trading, this is especially dangerous because simply running or testing the file can create unintended market exposure and immediate monetary loss.

Missing User Warnings

High

Confidence: 99% confidence
Finding: A hardcoded private trading key is embedded directly in the source file, exposing credentials to anyone who can read the skill and enabling unauthorized account access and trade placement. In the context of a monetized automated trading skill, this is extremely dangerous because compromise of the key can lead to direct theft, unauthorized leveraged positions, and irreversible financial damage.

Missing User Warnings

High

Confidence: 98% confidence
Finding: This skill can place real market or limit orders immediately when the handler receives a trade-related action, with no explicit confirmation step, preview, or out-of-band approval. In a trading skill context, this is especially dangerous because malformed inputs, prompt manipulation upstream, user misunderstanding, or accidental invocation can directly trigger irreversible financial transactions and losses.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: index.js:13

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: execute-trade-v2.mjs:3

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: execute-trade.mjs:3

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: final-trade.mjs:3

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: index.js:41

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILLPAY_CONFIG.md:50

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: test-fixed.mjs:89

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: test-trade.mjs:3

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: trade-final.mjs:3

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: trade-minvalue.mjs:3

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: trade-success.mjs:3