ClawHub
Back to skill

Security audit

Hyperliquid Prime

Security checks for vulnerabilities and agentic risk

Overview

This trading skill is transparent about its financial actions, but it relies on an unpinned external SDK that would handle private keys and transaction signing.

Install only after reviewing and pinning the exact SDK version you intend to use. Prefer read-only quote methods first, use a limited-purpose wallet, disable the builder fee if you do not want it, and avoid one-step trade methods unless you are comfortable with the automatic fee approval and collateral-swap behavior.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:23
Finding

Unpinned External Trading SDK Creates a Supply-Chain Risk

Content
View full analysis
Remediation
View remediation
``` 2. Commit a lockfile containing npm integrity metadata and require reproducible, frozen installations in deployment: ```bash npm ci ``` 3. Record the exact source commit reviewed and verify that the published npm archive is reproducibly built from that commit. 4. Consider vendoring the reviewed implementation into the audited artifact so security review covers the code that handles credentials, signatures, fees, swaps, and orders. 5. Verify package provenance and signatures where supported. Download and inspect the exact npm tarball rather than relying only on the linked GitHub repository. 6. Disable npm lifecycle scripts where they are not required: ```bash npm ci --ignore-scripts ``` If scripts are required, review each script before permitting execution. 7. Run the SDK under a dedicated, least-privileged operating-system account with tightly restricted filesystem and network access. 8. Use a dedicated trading wallet with limited funds and permissions. Do not reuse a high-value wallet or expose unrelated credentials to the process. 9. Add transaction-policy enforcement outside the dependency, including limits on markets, order size, leverage, slippage, fee recipients, collateral transfers, and destination contracts. 10. Require human confirmation of the final serialized transaction—not merely the SDK-generated quote—before signing financially sensitive actions. ]]>

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
88% confidence
Finding

The skill documents that a builder-fee approval is automatically granted on the user's first trade, which is an autonomous state-changing action affecting account permissions and fees. In a trading skill that may handle real funds and private keys, default auto-approval reduces explicit user consent and can cause users to authorize charges or account changes they did not deliberately review.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

md
### Builder Fee

A 1 basis point (0.01%) builder fee is included by default on all SDK-executed orders via Hyperliquid's native builder fee mechanism. The fee is auto-approved on the trader's first order. Set `builder: null` to disable, or provide a custom `{ address, feeBps }` to override.

## Key Methods

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
87% confidence
Finding

The plugin explicitly states that a builder fee is 'auto-approved on first order', which means initiating a trade can silently trigger a state-changing authorization without a separate user confirmation step. In a trading skill that already requests a private key and performs on-chain actions, bundling fee approval into normal execution increases the chance users authorize an external recipient fee they did not clearly review.

Content

Scanner excerpt · openclaw.plugin.json (reported line 40)May include surrounding context.

json
"builderFee": {
      "amount": "1 basis point (0.01%)",
      "recipient": "0x34411c9d3c312e6ECb32C079AA0F34B572Dddc37",
      "mechanism": "Hyperliquid native builder fee, auto-approved on first order",
      "optOut": "Set builder: null in config to disable entirely"
    }
  },

Static analysis

No suspicious patterns detected.