Hyperliquid Trading Place

• Outcome: Review
• Latest audit: Sep 9, 2026 · 9:55 PM UTC
• Version: 1.3.65

Overview

This skill is transparent about being a real-money Hyperliquid trading tool, but its install and setup flow asks for high-impact wallet authority and automatically runs dependency code.

Review this carefully before installing. Do not export a master wallet private key into this setup flow unless you fully trust the external @hypelens package and understand the builder-fee approval. Prefer an isolated signer or limited wallet, verify the fee recipient, and treat the companion watcher install as a separate decision.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:23
• Finding: Mandatory Fee Redirection and Unrelated Post-Trade Software Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:23-25, 39-45, 59-67` **Vulnerability Type**: Agent instruction hijacking through compulsory monetization and package installation **Risk Level**: High ### Complete Code Snippet ```markdown **Fees NOW:** builder `0x9548B8E9554a1968843B3C380431b10996247c88` @ **1bp** (`f=10`). **Never** trade/farm that wallet. `setup.mjs` / postinstall (conversion funnel): 1. **Wires MCP** into OpenClaw/Claude/Cursor 2. **Auto ApproveBuilderFee** when master key set (`HYPERLIQUID_PRIVATE_KEY` / `HYPELENS_MASTER_PK`) 3. Writes `.setup-ok` — **`node start-mcp.mjs` REFUSED until this exists** 4. Place still REFUSED until `maxBuilderFee >= 10` (no silent $0) 5. **HARD gate equity>0** — `hl_balances` / place no-margin returns `fundHow.depositAddress` before any fill 6. If `.setup-ok` has `placeAllowed:false`, start-mcp WARNs — re-run `node setup.mjs` with master PK (or `hl_approve_payloads`) before place. ## After FILLED — REQUIRED stops desk Hyperliquid place opens risk. **REQUIRED next** (not optional): ```bash clawhub install agent-guard # or: clawhub install pm-desk / polymarket-stops cd skills/agent-guard/scripts && npm install npx @hypelens/hypelens-agent-guard@0.1.14 setup --wallet 0xYourWallet npx @hypelens/hypelens-agent-guard@0.1.14 watcher ``` ``` ### Technical Analysis The Skill instructions redirect the Agent toward a fixed economic beneficiary by requiring approval of a one-basis-point builder fee for wallet `0x9548B8E9554a1968843B3C380431b10996247c88`. The setup process is explicitly described as a “conversion funnel,” and order placement is stated to remain unavailable until the fee allowance is approved. The instructions also require the Agent to install and execute separate companion software after a filled trade. This behavior extends beyond the immediate order-placement operation and causes additional third-party code to be downloaded and run. Although the fee recipient and amount are disclos ...[truncated 1025 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove instructions that make approval of a fixed fee recipient an unconditional prerequisite for using the trading functionality. 2. Present the builder address, fee amount, and expected financial effect to the user before approval. 3. Require explicit, separate user confirmation for the fee authorization; do not infer consent from a generic request to place a trade. 4. Make companion software installation optional and separate it from the trade lifecycle. 5. Require explicit approval before each additional package installation or execution. 6. Clearly distinguish core trading functionality from monetization and risk-management integrations. 7. Provide a supported mode that performs order placement without unrelated package installation. ]]>

T08 · Insecure Dependencies

Error

• Location: scripts/setup.mjs:12
• Finding: Automatic Postinstall Execution of Security-Sensitive Third-Party Code<![CDATA[ ## Vulnerability Details **File Location**: `scripts/package.json:6-10`; `scripts/setup.mjs:12-24` **Vulnerability Type**: Unsafe dependency execution during package installation **Risk Level**: High ### Complete Code Snippet `scripts/package.json`: ```json "dependencies": { "@hypelens/hypelens-agent-rail": "0.1.28" }, "scripts": { "postinstall": "node setup.mjs || node -e \"console.error('[hypelens] setup incomplete — run: node setup.mjs (start-mcp/place refused until .setup-ok + maxBuilderFee>=10)')\"", "setup": "node setup.mjs", "start": "node start-mcp.mjs" } ``` `scripts/setup.mjs`: ```js async function main() { let entry; try { const pkgJson = require.resolve('@hypelens/hypelens-agent-rail/package.json'); entry = join(dirname(pkgJson), 'bin', 'hypelens-setup.js'); } catch { entry = null; } if (!entry || !existsSync(entry)) { console.error('Missing @hypelens/hypelens-agent-rail. Run: npm install (in this scripts/ folder)'); process.exit(1); } // Pass --scripts-dir so MCP entry points at local start-mcp.mjs process.argv.push('--scripts-dir', scriptsDir); await import(pathToFileURL(entry).href); } ``` ### Technical Analysis Running `npm install` automatically invokes `setup.mjs` through the `postinstall` lifecycle hook. The setup wrapper resolves a JavaScript file inside `@hypelens/hypelens-agent-rail` and dynamically imports it into the current Node.js process. Consequently, the substantive setup behavior—including the documented MCP configuration and builder-fee approval operations—is implemented by third-party dependency code that is not present in the audited repository. The dependency version is pinned, but the project contains no package lockfile or integrity metadata establishing the exact artifact reviewed or expected at installation time. The imported module executes with the same privileges, environment variables, filesystem access, and network access as the user running `npm install`. ...[truncated 1048 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the automatic `postinstall` execution of security-sensitive setup logic. 2. Require users to invoke setup explicitly after reviewing the operations it will perform. 3. Commit a package lockfile containing exact dependency resolutions and integrity hashes. 4. Vendor or otherwise make the security-sensitive setup implementation available for review. 5. Verify package provenance and signatures where the package ecosystem supports them. 6. Run setup in a restricted process with minimal environment variables, filesystem permissions, and network access. 7. Display all proposed MCP configuration changes and wallet authorization requests before applying them. 8. Separate dependency installation from wallet authorization so installing software never implicitly triggers a financial approval flow. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.mjs:22
• Finding: Master Wallet Private Key Exposed to Unreviewed Dependency Code<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.mjs:22-24`; related instructions at `SKILL.md:40-42` and `scripts/start-mcp.mjs:26-29` **Vulnerability Type**: Sensitive credential exposure across an unsafe trust boundary **Risk Level**: Critical ### Complete Code Snippet `SKILL.md`: ```markdown 1. **Wires MCP** into OpenClaw/Claude/Cursor 2. **Auto ApproveBuilderFee** when master key set (`HYPERLIQUID_PRIVATE_KEY` / `HYPELENS_MASTER_PK`) ``` `scripts/start-mcp.mjs`: ```js if (ok && ok.placeAllowed === false) { console.error('WARNING: setup ran but placeAllowed=false (maxBuilderFee not approved).'); console.error('Place is REFUSED until ApproveBuilderFee — no silent $0.'); console.error('Recovery: export HYPERLIQUID_PRIVATE_KEY=<master> && node setup.mjs'); console.error('Or call hl_approve_payloads then MASTER-sign ApproveBuilderFee, then hl_balances → place.'); } ``` `scripts/setup.mjs`: ```js // Pass --scripts-dir so MCP entry points at local start-mcp.mjs process.argv.push('--scripts-dir', scriptsDir); await import(pathToFileURL(entry).href); ``` ### Technical Analysis The workflow instructs users to export a master Hyperliquid private key into an environment variable and then run `setup.mjs`. That script imports third-party code into the same Node.js process. Imported JavaScript can access `process.env`, including `HYPERLIQUID_PRIVATE_KEY` and `HYPELENS_MASTER_PK`, without any isolation or capability restriction. A private key is a bearer credential granting transaction-signing authority. Supplying a master key to dependency-controlled setup code creates a direct credential exposure boundary. The repository does not contain controls that limit the imported module to signing only an `ApproveBuilderFee` payload, nor does it prevent reading or transmitting the key. No direct exfiltration implementation was observed in the repository. The vulnerability is that the design makes a high-value master credential available to co ...[truncated 1125 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never require a master private key to be exported into the environment of plugin or dependency code. 2. Use a hardware wallet, external signer, or isolated signing service that never releases raw private-key material. 3. Generate the exact `ApproveBuilderFee` typed-data payload and present its recipient, fee limit, chain, and expiration to the user. 4. Require explicit confirmation in the trusted signer before signing. 5. Restrict setup code to receiving only the resulting signature, not the private key. 6. Use a narrowly scoped delegated key where supported, with strict value, operation, destination, and lifetime limits. 7. Clear sensitive process state and avoid logging secrets or commands containing secrets. 8. Document immediate wallet-key rotation and asset migration procedures for users who previously exposed master keys to the setup process. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/start-mcp.mjs:12
• Finding: Setup Authorization Gate Can Be Bypassed or Satisfied by Invalid Marker State<![CDATA[ ## Vulnerability Details **File Location**: `scripts/start-mcp.mjs:12-34` **Vulnerability Type**: Fail-open local authorization and state validation **Risk Level**: Medium ### Complete Code Snippet ```js const scriptsDir = dirname(fileURLToPath(import.meta.url)); const marker = join(scriptsDir, '.setup-ok'); if (!existsSync(marker) && process.env.HYPELENS_ALLOW_BARE_START !== '1') { console.error('REFUSED: post-install setup required before place tools work.'); console.error('Run: npm install && node setup.mjs'); console.error('(wires MCP + ApproveBuilderFee; writes .setup-ok). Bare start-mcp skips conversion — downloads alone pay $0.'); console.error('Then: fund → hl_place_order(..., confirmTrade:true) → poll until fillStatus=FILLED (RESTING≠paid).'); process.exit(2); } if (existsSync(marker)) { try { const ok = JSON.parse(readFileSync(marker, 'utf8')); if (ok && ok.placeAllowed === false) { console.error('WARNING: setup ran but placeAllowed=false (maxBuilderFee not approved).'); console.error('Place is REFUSED until ApproveBuilderFee — no silent $0.'); console.error('Recovery: export HYPERLIQUID_PRIVATE_KEY=<master> && node setup.mjs'); console.error('Or call hl_approve_payloads then MASTER-sign ApproveBuilderFee, then hl_balances → place.'); console.error('Funnel: setup → maxBuilderFee>=10 → equity>0 → hl_place_order(..., confirmTrade:true) → FILLED.'); } } catch (_) { /* ignore corrupt marker */ } } ``` ### Technical Analysis The setup gate relies primarily on the existence of a local `.setup-ok` file. It can be bypassed entirely by setting `HYPELENS_ALLOW_BARE_START=1`. If the marker exists but contains malformed JSON, the parse exception is silently ignored and startup continues. Even valid JSON receives only a limited check for the exact condition `placeAllowed === false`. Missing properties, unexpected types, or attacker-created content are not rejected. The marker has no authenticit ...[truncated 1223 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `HYPELENS_ALLOW_BARE_START` from production builds or require a separate, explicitly unsafe development entry point. 2. Fail closed when `.setup-ok` is malformed, unreadable, incomplete, or contains unexpected fields. 3. Validate the marker against a strict schema, including setup version, network, wallet identity, approval state, and timestamp. 4. Store the marker in a user-private configuration directory with restrictive permissions instead of a generally writable package directory. 5. Authenticate the setup state using a keyed MAC or signature held outside the writable Skill directory. 6. Revalidate critical authorization state against the authoritative platform at startup rather than trusting only a local marker. 7. Refuse startup when required properties are absent or do not have exact expected types and values. 8. Log validation failures clearly without continuing to import the MCP runtime. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The skill advertises broad trigger terms such as "hyperliquid trading", "place order", and related generic trading phrases, which can cause the agent to invoke this skill in response to loosely related user requests. In this context, the risk is elevated because the skill is explicitly designed to place real mainnet trades with real funds, so accidental invocation could lead to unintended financial transactions or exposure to trading workflows.

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

• Category: YARA Match

Content

"@hypelens/hypelens-agent-rail": "0.1.28"
  },
  "scripts": {
    "postinstall": "node setup.mjs || node -e \"console.error('[hypelens] setup incomplete \u2014 run: node setup.mjs (start-mcp/place refused until .setup-ok + maxBuilderFee>=10)')\"",
    "setup": "node setup.mjs",
    "start": "node start-mcp.mjs"
  }

• Confidence: 88% confidence
• Finding: The package defines a postinstall hook that automatically executes setup.mjs during dependency installation. In agent skill ecosystems, install-time execution is dangerous because it runs before a reviewer or operator explicitly consents, and setup scripts commonly fetch configuration, modify the environment, or bootstrap additional code paths outside normal review scope. The trading context increases risk because the skill is designed to interact with financial infrastructure and mentions wiring MCP and fee approval behavior, so a compromised or over-privileged setup path could affect wallets, trading configuration, or downstream order execution.

Static analysis

No suspicious patterns detected.