Hyperliquid

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:16 AM UTC
• Version: 1.0.0

Overview

This Hyperliquid skill is a disclosed read-only data helper, with local alias storage that users should understand before using account features.

Install this if you are comfortable using it to query wallet-linked Hyperliquid positions, balances, orders, and fills. Avoid saving aliases on shared or managed machines, review or delete ~/.clawdbot/hyperliquid/config.json if needed, and leave HYPERLIQUID_INFO_URL unset unless you intentionally trust the replacement API endpoint.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest and description present the skill as a read-only market-data assistant, but the documented scope also includes persistent local account-alias management and account-scoped queries. This mismatch can mislead users and reviewers about the actual behavior of the skill, reducing informed consent and increasing the chance that local state is modified or account identifiers are handled when the user expected a purely stateless data lookup tool.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: Labeling the skill as 'read-only' while documenting commands that add, remove, and set default aliases in a local config file is a capability misrepresentation. Even though the mutation is local rather than on-chain, the discrepancy can cause unintended state changes, hidden persistence, and weaker scrutiny from users who rely on the read-only label for safety expectations.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The reference file documents account-level endpoints such as positions, balances, open orders, and fills, which expands the skill's practical capability beyond the stated market-data-only scope. Even though these endpoints are read-only, they expose sensitive financial/account information and can lead an agent or future implementation to collect private user data without clear scope or consent boundaries.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The file exposes account-specific read operations such as clearinghouse state, open orders, and user fills even though the skill is described as a market-data assistant. In an agent setting, this creates a capability/manifest mismatch that can enable unauthorized inspection of wallet-linked trading activity or private account state if a user identifier is supplied.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The functions in this range are not necessary for basic public market-data retrieval and expand the skill into user-account surveillance. Because the Hyperliquid API appears read-only here, this is not direct fund-loss risk, but it does expose sensitive trading history and positions beyond the declared purpose of the tool.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill metadata describes a read-only market data assistant, but the imported capabilities include persistent account alias management and account-specific data retrieval. This scope mismatch is dangerous because users or higher-level orchestrators may grant trust based on the manifest and then unknowingly expose wallet-linked activity data or permit local state changes outside the declared role.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The command handler supports account add/remove/default operations that write to saved configuration, contradicting the stated market-data-only scope. Even if no blockchain transactions occur, persistent local configuration changes can alter future behavior, cause privacy issues, and violate least surprise for users and calling agents.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The natural-language fallback can save account aliases from free-form text, which expands state-changing behavior beyond the advertised read-only function and makes accidental invocation more likely. NL-triggered persistence is especially risky because ambiguous phrasing may cause unintended storage of wallet addresses or account labels without the user's clear understanding.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The inline comment says the account functionality is read-only, but the code immediately below performs configuration writes. Misleading security-relevant comments increase the chance that reviewers, users, or downstream agents misunderstand the true behavior and approve or invoke the skill under false assumptions.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The README tells users to save account aliases in a local config file but does not clearly warn that wallet addresses and labels will be persisted on disk. While addresses are public identifiers rather than secrets, silent local storage can create privacy and operational risk, especially on shared systems or machines with backups/sync enabled.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: Broad natural-language triggers such as 'top movers 24h' or 'book ETH' can overlap with ordinary conversation, increasing the chance of accidental invocation. In a skill that can contact an external API and also perform local alias-related actions, unintended activation can lead to unplanned network requests or stateful operations without clear user intent.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The documentation states that account aliases are stored locally in a persistent config file but does not prominently warn users in the skill description or capability summary that persistence occurs. This reduces transparency around local data retention and may cause users to disclose or store sensitive account labels/addresses without understanding they will remain on disk.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: Alias add/remove/default commands immediately modify saved configuration with no confirmation step or prior warning. In a chat-driven interface, that creates a risk of accidental state changes from ambiguous commands, prompt injection in surrounding tooling, or simple operator error affecting later account resolution.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/hyperliquid_api.mjs:4