Hyperliquid Radar

• Outcome: Review
• Latest audit: Sep 9, 2026 · 1:29 AM UTC
• Version: 1.0.5

Overview

The skill is mostly transparent read-only wallet research, but it also directs users toward an externally executed trading package for order placement without enough containment or verification detail.

Review this skill carefully before installing. Use it only with public wallet addresses, never provide seed phrases or private keys, and treat the `npx` packages as third-party executable code. If you use the trading handoff, run it in a restricted environment and verify the exact package source, publisher, and order details before approving any transaction.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:34
• Finding: Execution of an Unverified Third-Party Radar Package via npx## Vulnerability Details **File Location**: `SKILL.md`, line 34 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Complete Code Snippet**: ```bash npx @hypelens/hypelens-radar@0.1.5 ``` ### Technical Analysis The skill instructs users or agents to execute a third-party npm package directly through `npx`. An exact version is pinned, which reduces unintended version drift, but the project does not provide a lockfile, package integrity hash, signature verification, vendored source, or evidence that the referenced package was independently reviewed. Depending on the npm and `npx` configuration, the command can download the package from the configured registry and execute package-controlled code. Pinning the version does not protect against a compromised publisher account, malicious package release, registry compromise, local cache poisoning, or use of an untrusted registry mirror. The audited project contains only `SKILL.md`; no evidence was found that the referenced package is currently malicious. The risk arises from directing execution across an unverified supply-chain trust boundary. ### Attack Path 1. An attacker compromises the package publisher, registry entry, configured npm registry, or package delivery path. 2. Malicious content is introduced into or served in place of `@hypelens/hypelens-radar@0.1.5`. 3. A user or agent follows the skill instructions and executes the documented `npx` command. 4. `npx` retrieves or resolves the attacker-controlled package and runs its package binary or applicable installation behavior. 5. The malicious code operates with the permissions and environmental access of the invoking process. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user running `npx`. Accessible scope may include readable files, environment variables, local credentials, network resources, and writable files available to that ac ...[truncated 200 chars]
• Remediation: ## Remediation Suggestions - Vendor and review the executable implementation rather than downloading code at invocation time. - Publish and verify cryptographic integrity information for the exact package artifact. - Use a controlled package registry and a lockfile with verified integrity hashes where the installation workflow supports them. - Verify package publisher ownership, provenance attestations, and release signatures before execution. - Disable or restrict npm lifecycle scripts where operationally possible. - Run the package in a sandbox or container with a minimal environment, read-only filesystem access, restricted network destinations, and no unrelated credentials. - Execute it under a dedicated low-privilege account and avoid exposing wallet secrets, API tokens, SSH credentials, or cloud credentials to the process. - Document the expected package checksum and provide a reproducible verification procedure.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:61
• Finding: Execution of an Unverified Trading Package via npx## Vulnerability Details **File Location**: `SKILL.md`, line 61 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Complete Code Snippet**: ```bash npx @hypelens/hypelens-agent-rail@0.1.21 ``` ### Technical Analysis The skill redirects trade requests to a separate third-party npm package executed through `npx`. Although the dependency is pinned to version `0.1.21`, the project provides no integrity hash, lockfile, signature, vendored implementation, or package audit evidence. The referenced component is security-sensitive because the surrounding instructions associate it with `hl_place_order` and order execution. If the package or its delivery channel were compromised, attacker-controlled code could run locally and potentially interfere with transaction parameters, trade intent, credentials, or wallet integrations made available to that process. No evidence in the audited file proves that this package is malicious. The finding concerns the unsafe reliance on externally retrieved executable code for a high-impact trading workflow. ### Attack Path 1. An attacker compromises the package publisher account, npm registry record, registry mirror, or package delivery path. 2. The attacker causes malicious code to be distributed or resolved as `@hypelens/hypelens-agent-rail@0.1.21`. 3. A user asks to trade and follows the documented command. 4. `npx` downloads or resolves and executes the attacker-controlled package with the user's privileges. 5. The package accesses resources exposed to the process and may tamper with order construction, destinations, prices, sizes, or authorization interactions. 6. If the user subsequently authorizes an altered operation, the attacker-controlled workflow may cause unintended trading activity or financial loss. ### Impact Assessment At the host level, exploitation could provide arbitrary code execution with the invoking user's permissions, including access to r ...[truncated 519 chars]
• Remediation: ## Remediation Suggestions - Do not execute trading infrastructure directly from an unverified registry artifact. - Vendor and independently audit the exact source used for order-placement operations. - Pin and verify the package artifact with cryptographic integrity metadata and trusted provenance attestations. - Separate read-only research functionality from all trading and wallet-access processes. - Run the trading component under least privilege with strict filesystem, environment, and network isolation. - Never expose seed phrases or private keys to the package; use narrowly scoped signing mechanisms or hardware-backed authorization. - Display the complete asset, side, size, price, order type, destination, and maximum cost before requesting explicit user approval. - Bind approval to the exact serialized order so that parameters cannot be changed after confirmation. - Add transaction and order limits, destination allowlists, audit logging, and an emergency revocation mechanism. - Verify the expected registry, publisher identity, release signature, and artifact checksum before every installation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.