Hyperliquid Trading Place

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:22 AM UTC
• Version: 1.0.32

Overview

This skill is a disclosed Hyperliquid trading helper, but it runs wallet-sensitive setup and trading code from an unreviewed npm dependency during install/runtime.

Review before installing. Use only isolated, low-balance or revocable trading credentials, avoid exposing a master private key through the shell environment, and verify the exact npm package contents/provenance before running npm install or setup.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: scripts/package.json:6

Finding

Wallet-Sensitive Setup and Trading Operations Delegated to an Unverified Third-Party Dependency

Content

View full analysis

=10)')\"", ``` `scripts/setup.mjs:11-25`: ```js async function main() { let entry; try { const pkgJson = require.resolve('@hypelens/hypelens-agent-rail/package.json'); entry = join(dirname(pkgJson), 'bin', 'hypelens-setup.js'); } catch { entry = null; } if (!entry || !existsSync(entry)) { console.error('Missing @hypelens/hypelens-agent-rail. Run: npm install (in this scripts/ folder)'); process.exit(1); } // Pass --scripts-dir so MCP entry points at local start-mcp.mjs process.argv.push('--scripts-dir', scriptsDir); await import(pathToFileURL(entry).href); } ``` `scripts/start-mcp.mjs:31-40`: ```js console.error('Recovery: export HYPERLIQUID_PRIVATE_KEY= && node setup.mjs'); console.error('Or call hl_approve_payloads then MASTER-sign ApproveBuilderFee, then hl_balances → place.'); console.error('Funnel: setup → maxBuilderFee>=10 → equity>0 → hl_place_order(..., confirmTrade:true) → FILLED.'); } } catch (_) { /* ignore corrupt marker */ } } const require = createRequire(import.meta.url); try { const pkgJson = require.resolve('@hypelens/hypelens-agent-rail/package.json'); const pkg = require(pkgJson); ``` The runtime subsequently resolves the dependency-provided executable and imports it: ```js const binRel = (pkg.bin && (pkg.bin['hypelens-rail-mcp'] || pkg.bin['hypelens-agent-rail'])) || 'bin/hypelens-rail-mcp. ...[truncated 3907 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/package.json (reported line 10)May include surrounding context.

json

{
  "name": "hyperliquid-place-scripts",
  "version": "1.0.29",
  "private": true,
  "type": "module",
  "dependencies": {
    "@hypelens/hypelens-agent-rail": "0.1.28"
  },
  "scripts": {
    "postinstall": "node setup.mjs || node -e \"console.error('[hypelens] setup incomplete — run: node setup.mjs (start-mcp/place refused until .setup-ok + maxBuilderFee>=10)')\"",
    "setup": "node setup.mjs",
    "start": "node start-mcp.mjs"
  }
}

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill explicitly requires running npm install and a postinstall setup script, which implies execution of local code and likely access to environment variables or secrets, yet it declares no permissions or allowed-tools scope. In an agent setting, this mismatch reduces transparency and can allow broader-than-expected access to sensitive environment data during installation or runtime.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.