Security audit

HypurrFi

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent DeFi lending skill, but it needs Review because it creates and stores a raw wallet private key locally and can sign high-impact on-chain transactions with under-disclosed persistent approvals and limited safety controls.

Install only if you are comfortable with an agent-managed DeFi wallet. Use a dedicated low-balance wallet, protect or replace ~/.hyperliquid-wallet.json, review every transaction before using --yes, avoid relying on unimplemented advertised markets, and check or revoke ERC-20 allowances after repayments.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/setup.js:54
Finding: Plaintext Private Key Is Created Before Restrictive Permissions Are Applied
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/repay.js:152
Finding: Repayment Grants a Persistent Unlimited Token Allowance
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/borrow.js:84
Finding: Borrow Execution Lacks Requested-Amount and Projected Health-Factor Safety Checks
Content: View full analysis
1000 ? '∞' : healthNum.toFixed(2); const availableUSD = formatUnits(availableBorrows, 8); // Preview mode if (!yesFlag) { let warning = null; if (healthNum < 1.5 && healthNum < 1000) { warning = 'Health factor is low. Adding debt increases liquidation risk.'; } output({ preview: true, market: market.name, token: token.symbol, amount: amountStr, currentHealth: healthDisplay, availableBorrows: Number(availableUSD).toFixed(2), warning }); return; } // Execute borrow let txHash; if (tokenKey === 'hype') { const gatewayAbi = parseAbi(WRAPPED_HYPE_GATEWAY_ABI); txHash = await walletClient.sendTransaction({ to: market.wrappedHypeGateway, data: encodeFunctionData({ abi: gatewayAbi, functionName: 'borrowETH', args: [market.pool, amount, 2, 0] }), chain: { id: CHAIN.id, name: CHAIN.name } }); } else { txHash = await walletClient.sendTransaction({ to: market.pool, data: encodeFunctionData({ abi: poolAbi, functionName: 'borrow', args: [token.address, amount, 2, 0, account.address] }), chain: { id: CHAIN.id, name: CHAIN.name } }); } ``` ### Technical Analysis The command retrieves the current health factor and available borrowing capacity, but it does not enforce either value before sending the transaction. Specifically, it does not: - Convert the requested token amount ...[truncated 1949 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (32)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The reported behavior includes local wallet generation and persistent private-key storage, while the skill is presented primarily as a lending workflow. Hiding sensitive credential creation/storage behind a DeFi skill description materially increases risk because users may run setup steps without appreciating that private keys are being created on disk and then used for irreversible on-chain actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The reported behavior includes local wallet generation and persistent private-key storage, while the skill is presented primarily as a lending workflow. Hiding sensitive credential creation/storage behind a DeFi skill description materially increases risk because users may run setup steps without appreciating that private keys are being created on disk and then used for irreversible on-chain actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The reported behavior includes local wallet generation and persistent private-key storage, while the skill is presented primarily as a lending workflow. Hiding sensitive credential creation/storage behind a DeFi skill description materially increases risk because users may run setup steps without appreciating that private keys are being created on disk and then used for irreversible on-chain actions.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
node scripts/deposit.js pooled usdt0 100 --json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
md
node scripts/deposit.js pooled usdt0 100 --json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
node scripts/deposit.js pooled usdt0 100 --json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
md
node scripts/deposit.js pooled usdt0 100 --json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
md
node scripts/deposit.js pooled usdt0 100 --json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
md
node scripts/deposit.js pooled usdt0 100 --json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
md
node scripts/deposit.js pooled usdt0 100 --json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.
md
node scripts/deposit.js pooled usdt0 100 --json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.
md
node scripts/deposit.js pooled usdt0 100 --json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.
md
node scripts/deposit.js pooled usdt0 100 --json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
node scripts/positions.js --json

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
node scripts/withdraw.js <market> <token> <amount|max> [--yes] [--json]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
node scripts/withdraw.js <market> <token> <amount|max> [--yes] [--json]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
md
node scripts/withdraw.js <market> <token> <amount|max> [--yes] [--json]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
node scripts/borrow.js <market> <token> <amount> [--yes] [--json]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
md
node scripts/borrow.js <market> <token> <amount> [--yes] [--json]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.
md
node scripts/borrow.js <market> <token> <amount> [--yes] [--json]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.
md
node scripts/repay.js <market> <token> <amount|max> [--yes] [--json]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.
md
node scripts/repay.js <market> <token> <amount|max> [--yes] [--json]

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
md
node scripts/repay.js <market> <token> <amount|max> [--yes] [--json]

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The lockfile pins ws to version 8.18.3, and the finding cites known advisories affecting that exact version. Because viem depends on ws, any skill functionality using WebSocket-based RPC or subscriptions could expose the agent process to memory disclosure or denial-of-service conditions if it connects to a malicious or compromised endpoint. In a DeFi skill, persistent RPC/WebSocket connections are plausible, which makes this more operationally dangerous than an unused library issue.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill describes executing local Node scripts that manage wallets and submit blockchain transactions, yet it declares no explicit tool scope or permissions. In an agent setting, missing scope boundaries can let the skill access environment data or execute code more broadly than a user expects, increasing the chance of unintended secret exposure or unsafe transaction flow.
Content: No source excerpt is available for this finding.