Supurr Hyperliquid Algorithmic Trading

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:00 PM UTC
• Version: 1.0.0

Overview

This trading-bot skill needs Review because it uses unverified remote installers and plaintext wallet-key handling for software that can deploy live trading bots.

Install only after you are comfortable trusting Supurr's remote installer, release hosting, and CLI binaries with the user account running the installer and with any Hyperliquid API-wallet key you provide. Prefer a pinned, checksum- or signature-verified release path, use a restricted API wallet and subaccount, review generated configs before deploy, avoid putting real keys in shell history, and rotate any key previously supplied on the command line.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/skill-install.sh:157

Finding

Mutable Remote Installation Scripts Are Executed Directly Through a Shell

Content

View full analysis

/dev/null; then info "Installing Supurr CLI..." curl -fsSL https://cli.supurr.app/install | bash else completed "Supurr CLI already installed: $(supurr --version 2>/dev/null || echo 'unknown')" fi ``` The same unsafe installation pattern is presented to users in `README.md`: ```bash curl -fsSL https://cli.supurr.app/skill-install | bash curl -fsSL https://cli.supurr.app/install | bash ``` ### Technical Analysis The installer downloads shell code from a mutable external URL and immediately passes it to `bash`. There is no version pinning, expected hash, digital-signature verification, content review step, or trusted local copy used for execution. HTTPS protects the connection in transit under normal conditions, but it does not guarantee that the server will continue serving the same content that was reviewed in this repository. Control of the web server, deployment pipeline, domain, DNS configuration, or associated credentials would allow the effective installation payload to be changed without modifying this audited project. This behavior is not required to install the checked-in Skill. A safer installation workflow can download a versioned artifact, authenticate it, and only then execute it. ### Attack Path 1. An attacker compromises `cli.supurr.app`, its deployment pipeline, DNS configuration, or release credentials. 2. The attacker replaces the response from `/install` or `/skill-install` with malicious shell commands. 3. A user follows the recommended `curl ... | bash` instructions, or runs `skill-install.sh` while the CLI is absent. 4. The attacker-controlled response is executed immediately by the user's shell. 5. Th ...[truncated 946 chars]

Remediation

View remediation

supurr-install.sh' | shasum -a 256 -c - ``` 5. Digitally sign release artifacts and verify the signature against a pinned public key. 6. Let users inspect the downloaded script before explicitly invoking it. 7. Pin documentation to a specific release rather than an unversioned endpoint. 8. Make signature or checksum failure fatal; never fall back to executing unverified content. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install.sh:103

Finding

Installer Downloads and Executes Unverified Opaque Binaries

Content

View full analysis

/dev/null; then curl -fsSL "$download_url" -o "$INSTALL_DIR/supurr" || error "Download failed. Check if binary exists at $download_url" elif command -v wget &>/dev/null; then wget -q "$download_url" -O "$INSTALL_DIR/supurr" || error "Download failed. Check if binary exists at $download_url" else error "Neither curl nor wget found. Please install one of them." fi # Make executable chmod +x "$INSTALL_DIR/supurr" success "CLI installed: $INSTALL_DIR/supurr" # Download bot engine binary local bot_download_url="${SUPURR_DOWNLOAD_URL}/bot-${platform}" info "Downloading backtest engine..." if command -v curl &>/dev/null; then curl -fsSL "$bot_download_url" -o "$INSTALL_DIR/bot" 2>/dev/null && { chmod +x "$INSTALL_DIR/bot" success "Engine installed: $INSTALL_DIR/bot" } || { warn "Backtest engine not available for $platform (optional)" } elif command -v wget &>/dev/null; then wget -q "$bot_download_url" -O "$INSTALL_DIR/bot" 2>/dev/null && { chmod +x "$INSTALL_DIR/bot" success "Engine installed: $INSTALL_DIR/bot" } || { warn "Backtest engine not available for $platform (optional)" } fi ``` The downloaded CLI is then executed: ```bash export PATH="$INSTALL_DIR:$PATH" if "$INSTALL_DIR/supurr" --version &>/dev/null; then success "Installation verified!" else warn "Binary downloaded but may need additional dependencies" fi ``` ### Technical Analysis The script obtains `supurr` and `bot` executables from: ```bash SUPURR_DOWNLOAD_URL="${SUPURR_DOWNLOAD_URL:-https://cli.supurr.app/releases}" ``` The artifact names are selected only by platform and are not tied to an immutab ...[truncated 1900 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:45

Finding

API-Wallet Private Keys Are Accepted Through Process Arguments and Stored in Plaintext

Content

View full analysis

` | Wallet address (0x...) | | `--api-wallet ` | API wallet private key | ``` The documented storage layout explicitly places the private key in a JSON file: ```text ~/.supurr/ ├── credentials.json # { address, private_key } ├── configs/ # Saved bot configs │ ├── btc-grid.json │ ├── hype-usdc.json │ └── ... └── cache/ # Price data cache ``` Tutorials encourage the same argument-based key submission, for example: ```bash # First time only — saves to ~/.supurr/credentials.json supurr init --address 0xYOUR_WALLET --api-wallet 0xYOUR_API_KEY ``` ### Technical Analysis A secret supplied as a command-line argument can be exposed through shell history, process inspection, terminal logs, session recording, troubleshooting output, or automation logs. The documentation repeatedly promotes this invocation instead of limiting key entry to hidden interactive input. The documented credentials file contains `{ address, private_key }` in plaintext. The audited repository does not provide the CLI implementation, so it cannot demonstrate that the file is created atomically with restrictive permissions such as `0600`, encrypted at rest, or protected through an operating-system credential store. Storing a signing key may be necessary for automated trading, but exposing it in process arguments and relying on an ...[truncated 1328 chars]

Remediation

View remediation

` from recommended usage and preferably from the CLI interface. 2. Read the key from a hidden interactive prompt that disables terminal echo. 3. For automation, accept a file descriptor or integrate with an established secret manager rather than placing the value in process arguments or ordinary environment variables. 4. Store credentials in the operating system's keychain or credential vault. 5. If file storage is unavoidable: - Create the directory with mode `0700`. - Create the credential file atomically with mode `0600`. - Reject symlinks and unsafe ownership. - Never print the key in logs or error output. - Encrypt the value using a key protected by the operating system. 6. Add a migration command that removes legacy plaintext keys after secure import. 7. Document API-wallet scope, revocation, rotation, backup, and incident-response procedures. 8. Warn users to delete any shell-history entries that contain previously supplied keys. ]]>

T08 · Insecure Dependencies

Error

• Location: scripts/skill-install.sh:48

Finding

Unpinned Repository Content Replaces Existing Skills Across Multiple AI Agents

Content

View full analysis

/dev/null || true if [ -f "$temp_dir/SKILL.md" ]; then mkdir -p "$skills_dir/supurr" cp "$temp_dir/SKILL.md" "$skills_dir/supurr/" cp "$temp_dir/README.md" "$skills_dir/supurr/" 2>/dev/null || true completed "$name → ${CYAN}$skills_dir/supurr${NC}" return 0 fi return 1 } ``` The installer defines targets for numerous agent products: ```bash declare -a TARGETS=( "$HOME/.agents/skills|Universal Agents" "$HOME/.agent/skills|Antigravity" "$HOME/.amp/skills|Amp" "$HOME/.augment/skills|Augment" "$HOME/.claude/skills|Claude Code" "$HOME/.cline/skills|Cline" "$HOME/.codebuddy/skills|CodeBuddy" "$HOME/.codex/skills|OpenAI Codex" "$HOME/.commandcode/skills|Command Code" "$HOME/.continue/skills|Continue" "$HOME/.cursor/skills|Cursor" "$HOME/.gemini-cli/skills|Gemini CLI" "$HOME/.github-copilot/skills|GitHub Copilot" "$HOME/.kimi-code-cli/skills|Kimi Code CLI" "$HOME/.config/opencode/skill|OpenCode" "$HOME/.openclaw/skills|OpenClaw" "$HOME/.roo/skills|Roo" "$HOME/.trae/skills|Trae" "$HOME/.void/skills|Void" "$HOME/.windsurf/skills|Windsurf" "$HOME/.zed/skills|Zed" ) ``` It then clones the current default branch without pinning a commit and installs it into every detected target: ```bash info "Downloading from ${CYAN}$REPO${NC}..." temp_dir=$(mktemp -d) git clone --depth 1 --quiet "$REPO" "$temp_dir" printf "\n" installed=0 for target in "${FOUND[@]}"; do dir="${target%%|*}" na ...[truncated 2254 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (40)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

This command fetches an external script from cli.supurr.app and immediately executes it in the shell, creating a direct arbitrary code execution primitive controlled by remote content. Because it installs an AI skill into user tooling, compromise could affect both the local environment and downstream agent behavior.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

bash

# Install AI skill to your tools
curl -fsSL https://cli.supurr.app/skill-install | bash

Also Install: Supurr CLI

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The | bash chaining pattern removes any opportunity for inspection between download and execution, making malicious or altered content execute immediately. This is a well-known unsafe pattern because it collapses retrieval and code execution into one step with no integrity gate.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

bash

# Install AI skill to your tools
curl -fsSL https://cli.supurr.app/skill-install | bash

Also Install: Supurr CLI

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The CLI install command executes a remotely hosted script with full user shell privileges, so any tampering with the script or its delivery infrastructure leads to immediate system compromise. Since this CLI later handles trading bot operations and credentials, successful exploitation could expose sensitive wallet-related data or alter trading actions.

Content

Scanner excerpt · README.md (reported line 27)May include surrounding context.

The skill teaches AI assistants to use the CLI. The skill installer automatically installs the CLI, but you can also install it manually:

bash

curl -fsSL https://cli.supurr.app/install | bash

Available Skills

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Again using | bash for manual CLI installation reinforces unsafe operator habits and allows any transient compromise of the remote source to become instant shell execution. The danger is amplified because users may assume the pattern is endorsed and routine.

Content

Scanner excerpt · README.md (reported line 27)May include surrounding context.

The skill teaches AI assistants to use the CLI. The skill installer automatically installs the CLI, but you can also install it manually:

bash

curl -fsSL https://cli.supurr.app/install | bash

Available Skills

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Placing external script execution in Quick Start elevates risk because users are primed to run it immediately, often without review. In a trading-related skill, this is more dangerous than a generic utility because the installed software may later interact with accounts, bots, and operational credentials.

Content

Scanner excerpt · README.md (reported line 40)May include surrounding context.

bash

# 1. Install CLI
curl -fsSL https://cli.supurr.app/install | bash

# 2. Setup credentials
supurr init --address 0x... --api-wallet 0x...

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Using | bash in the Quick Start path maximizes exploitability because it targets the most commonly followed setup flow. In the context of an agent skill, such commands may be reproduced by automation, increasing the chance of unattended execution of attacker-controlled code.

Content

Scanner excerpt · README.md (reported line 40)May include surrounding context.

bash

# 1. Install CLI
curl -fsSL https://cli.supurr.app/install | bash

# 2. Setup credentials
supurr init --address 0x... --api-wallet 0x...

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about trading-bot functionality on Hyperliquid, but the supplied code chunk does not implement any trading, backtesting, deployment, monitoring, or exchange interaction. Its actual purpose is installation/bootstrap: detecting supported AI tool directories, cloning a repository, copying skill metadata files, and installing the Supurr CLI if missing. That is a materially different primary purpose and includes undeclared capabilities related to local filesystem modification and remote code download/execution.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

A self-update feature enables the tool to modify its own code after deployment. In security-sensitive software handling wallet credentials and trading actions, self-modification raises supply-chain and integrity risks, especially if updates are not pinned, signed, or explicitly approved.

Content

Scanner excerpt · SKILL.md (reported line 466)May include surrounding context.

---

12. supurr update — Self-Update

bash

supurr update    # Check and install latest version

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The documented storage layout explicitly places private_key inside ~/.supurr/credentials.json, which is direct credential exposure at rest. Because this skill can deploy and stop live trading bots, compromise of that file can lead to unauthorized bot control and potentially theft or loss of funds.

Content

Scanner excerpt · SKILL.md (reported line 558)May include surrounding context.

text

~/.supurr/
├── credentials.json      # { address, private_key }
├── configs/              # Saved bot configs
│   ├── btc-grid.json
│   ├── hype-usdc.json

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The script explicitly instructs users to execute a remote installer with 'curl ... | bash', which removes the opportunity to inspect the script before execution and creates a direct remote code execution path. In the context of a trading-bot CLI that may later access wallets, API keys, and exchange infrastructure, compromise of the hosting endpoint or TLS trust chain could lead to theft of credentials or deployment of malicious binaries.

Content

Scanner excerpt · scripts/install.sh (reported line 4)May include surrounding context.

sh

#!/usr/bin/env bash
# =============================================================================
# Supurr CLI Installer
# Usage: curl -fsSL https://cli.supurr.app/install | bash
# =============================================================================
set -euo pipefail

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

Piping a fetched script directly into bash is a classic chaining-abuse pattern because it combines retrieval and execution into one opaque step. This is especially dangerous here because the skill concerns automated trading infrastructure, so a malicious installer could establish control before the user notices and then tamper with wallets, bot configs, PATH entries, or downloaded binaries.

Content

Scanner excerpt · scripts/install.sh (reported line 4)May include surrounding context.

sh

#!/usr/bin/env bash
# =============================================================================
# Supurr CLI Installer
# Usage: curl -fsSL https://cli.supurr.app/install | bash
# =============================================================================
set -euo pipefail

External Script Fetching

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The documented usage instructs users to run a remote script directly with bash, normalizing unsafe installation behavior and eliminating an inspection step. Even if the current script is benign, the delivery model means any future compromise of the hosting path results in arbitrary code execution on user systems.

Content

Scanner excerpt · scripts/skill-install.sh (reported line 4)May include surrounding context.

sh

#!/usr/bin/env bash
# =============================================================================
# Supurr Skill Installer
# Usage: curl -fsSL https://cli.supurr.app/skill-install | bash
# =============================================================================
set -e

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The documented command chains network retrieval directly into shell execution, a classic high-risk pattern that bypasses review and integrity validation. Given this is an installer for software associated with trading bots, compromise could rapidly lead to credential theft, wallet compromise, or malicious bot deployment.

Content

Scanner excerpt · scripts/skill-install.sh (reported line 4)May include surrounding context.

sh

#!/usr/bin/env bash
# =============================================================================
# Supurr Skill Installer
# Usage: curl -fsSL https://cli.supurr.app/skill-install | bash
# =============================================================================
set -e

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The rm -rf operation targets a path derived from function input and recursively deletes an existing skill directory without validation or confirmation. In this script the inputs come from hardcoded target lists, which reduces but does not eliminate risk; if path assumptions are changed, symlinked, or reused elsewhere, destructive deletion could affect unintended locations.

Content

Scanner excerpt · scripts/skill-install.sh (reported line 52)May include surrounding context.

sh

local temp_dir="$3"

  mkdir -p "$skills_dir"
  rm -rf "$skills_dir/supurr" 2>/dev/null || true

  if [ -f "$temp_dir/SKILL.md" ]; then
    mkdir -p "$skills_dir/supurr"

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script performs curl-piped-to-bash execution without any safety warning or confirmation, causing immediate execution of unreviewed network-fetched shell code. This is especially dangerous because the script already targets multiple local tool directories, so a compromised installer could combine remote execution with broad modification of the user's AI tooling environment.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

This line directly fetches and executes another remote script, granting full shell execution to content not embedded in or auditable from this repository. Because the skill's purpose is trading-bot support, compromise here could expose API keys, wallet material, shell history, or modify trading automation on the host.

Content

Scanner excerpt · scripts/skill-install.sh (reported line 159)May include surrounding context.

sh

# Install CLI if not present
if ! command -v supurr &>/dev/null; then
  info "Installing Supurr CLI..."
  curl -fsSL https://cli.supurr.app/install | bash
else
  completed "Supurr CLI already installed: $(supurr --version 2>/dev/null || echo 'unknown')"
fi

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script executes remote code from https://cli.supurr.app/install via curl-pipe-to-bash, which gives the remote endpoint immediate code execution on the user's machine. In the context of a skill installer, this behavior is not justified by the minimal task of installing markdown skill content and materially increases the chance of compromise if the endpoint, CDN, DNS, or TLS trust chain is abused.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This command chains curl output directly into bash, allowing a remote server to execute arbitrary shell code instantly. In a trading context, the host may contain exchange credentials, strategy code, wallets, and agent integrations, which makes the blast radius substantially higher than a normal desktop utility installer.

Content

Scanner excerpt · scripts/skill-install.sh (reported line 159)May include surrounding context.

sh

# Install CLI if not present
if ! command -v supurr &>/dev/null; then
  info "Installing Supurr CLI..."
  curl -fsSL https://cli.supurr.app/install | bash
else
  completed "Supurr CLI already installed: $(supurr --version 2>/dev/null || echo 'unknown')"
fi

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/skill-install.sh (reported line 167)May include surrounding context.

sh

printf "\n"
warn "Restart your AI tool(s) to load the skill."
printf "\n"
info "Re-run anytime to update: ${CYAN}curl -fsSL https://cli.supurr.app/skill-install | bash${NC}"
printf "\n"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tutorials/grid.md (reported line 27)May include surrounding context.

1️⃣ Setup Credentials

bash

# First time only — saves to ~/.supurr/credentials.json
supurr init --address 0xYOUR_WALLET --api-wallet 0xYOUR_API_KEY

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence

Finding

The README recommends running npx skills add Supurr-App/supurr_skill without pinning a package version or commit, which means users may receive whatever the registry resolves at install time. If the referenced package or dependency chain is compromised, an attacker could deliver altered code or installation behavior to users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README instructs users to execute a remote script directly with curl ... | bash and provides no warning that this grants the remote server immediate code execution on the user's machine. This is dangerous because any compromise of the hosting domain, TLS termination, or upstream script source becomes an instant arbitrary command execution path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manual CLI installation repeats the same remote pipe-to-shell pattern without any safety guidance, normalizing unsafe execution of unaudited remote code. Repetition increases the likelihood that users or agents will execute it automatically without scrutiny.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Including curl ... | bash in the Quick Start makes unsafe remote code execution the default onboarding path, encouraging copy-paste execution before users understand the trust model or system modifications involved. In an AI skill context, concise quick-start commands are especially likely to be replayed automatically by tools or assistants.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

The skill documents shell-capable CLI operations but does not declare any tool scope or allowed-tools constraints. In an agent setting, that omission weakens sandboxing and increases the chance the agent will execute commands such as deploy, stop, or update without explicit limitation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.