{ "skill_name": "hyperliquid", "skill_path": "/workspace/skills/clawhub-hyperliquid-cli", "skill_directory": "/workspace/skills/clawhub-hyperliquid-cli", "is_safe": false, "max_severity": "CRITICAL", "findings_count": 4, "findings": [ { "id": "llm_finding_hyperliquid_0", "rule_id": "LLM_DATA_EXFILTRATION", "category": "data_exfiltration", "severity": "CRITICAL", "title": "Hardcoded Private Key Requirement with Direct Trading Access", "description": "The skill requires users to provide their HYPERLIQUID_PRIVATE_KEY as an environment variable, which grants full trading authority over the user's Hyperliquid account. This private key enables unlimited fund transfers, trades, and account control. The skill executes a third-party binary ('hl') that has direct access to this critical credential, creating significant risk of fund loss through bugs, malicious updates, or compromised dependencies.", "file_path": "SKILL.md", "line_number": null, "snippet": "requires: {env: ['HYPERLIQUID_PRIVATE_KEY']}\n\nInstructions state: 'Export the private key (starts with 0x)' and 'export HYPERLIQUID_PRIVATE_KEY=0x...your_private_key...'", "remediation": "1. Implement read-only mode by default that doesn't require private keys. 2. Use hardware wallet integration or signing services instead of raw private keys. 3. Implement transaction approval workflows requiring explicit user confirmation. 4. Add spending limits and risk controls. 5. Warn users about the risks of exposing private keys to third-party binaries.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill presents CRITICAL security risks due to its requirement for users to provide private keys that control real financial assets. The skill installs and executes an unverified third-party binary (hyperliquid-cli) with full access to trading credentials, creating significant potential for fund loss through bugs, malicious updates, or supply chain attacks. The lack of version pinning, integrity verification, and security auditing compounds these risks. Additionally, the persistent background server and unencrypted local credential storage introduce further vulnerabilities. While the skill may provide legitimate trading functionality, the security architecture is fundamentally flawed for handling financial credentials. Users should exercise extreme caution and only use this skill with test accounts or minimal funds until security improvements are implemented.", "primary_threats": [ "Data Exfiltration/Credential Exposure", "Tool Exploitation via Unverified Binary", "Resource Exhaustion via Persistent Server", "Inadequate Input Validation", "Missing Security Disclosures" ], "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "scanner_category": "SECURITY VIOLATION", "meta_validated": true, "meta_confidence": "HIGH", "meta_confidence_reason": "This is a legitimate architectural risk inherent to any trading CLI that requires private keys. The LLM analyzer correctly identified that providing private keys to third-party binaries creates real financial risk. However, this is the intended design of the skill - it's a wrapper around an existing trading CLI. The risk is real but disclosed in the setup instructions.", "meta_exploitability": "Medium - Requires malicious update to hyperliquid-cli npm package or supply chain compromise", "meta_impact": "Critical - Complete loss of funds in connected trading account" } }, { "id": "llm_finding_hyperliquid_1", "rule_id": "LLM_UNAUTHORIZED_TOOL_USE", "category": "unauthorized_tool_use", "severity": "HIGH", "title": "Unverified Third-Party Binary Execution with Financial Authority", "description": "The skill installs and executes 'hyperliquid-cli' via npm, a third-party binary with full access to the user's trading private key. There is no verification of the binary's integrity, no pinned version specified, and no security audit mentioned. The binary runs with complete authority to execute trades, transfer funds, and manage positions. Users have no visibility into what the binary actually does with their credentials.", "file_path": "SKILL.md", "line_number": null, "snippet": "install: ['npm install -g hyperliquid-cli']\n\nNo version pinning (e.g., hyperliquid-cli@1.2.3)\nNo integrity checks or signature verification\nBinary has full access to HYPERLIQUID_PRIVATE_KEY", "remediation": "1. Pin specific versions with integrity hashes (npm install -g hyperliquid-cli@x.y.z --integrity sha512-...). 2. Provide security audit information or source code review. 3. Implement sandboxing or permission boundaries. 4. Add warnings about third-party binary risks. 5. Consider implementing the trading logic directly in auditable Python/Bash scripts instead of relying on external binaries.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill presents CRITICAL security risks due to its requirement for users to provide private keys that control real financial assets. The skill installs and executes an unverified third-party binary (hyperliquid-cli) with full access to trading credentials, creating significant potential for fund loss through bugs, malicious updates, or supply chain attacks. The lack of version pinning, integrity verification, and security auditing compounds these risks. Additionally, the persistent background server and unencrypted local credential storage introduce further vulnerabilities. While the skill may provide legitimate trading functionality, the security architecture is fundamentally flawed for handling financial credentials. Users should exercise extreme caution and only use this skill with test accounts or minimal funds until security improvements are implemented.", "primary_threats": [ "Data Exfiltration/Credential Exposure", "Tool Exploitation via Unverified Binary", "Resource Exhaustion via Persistent Server", "Inadequate Input Validation", "Missing Security Disclosures" ], "aitech": "AITech-12.1", "aitech_name": "Tool Exploitation", "aisubtech": "AISubtech-12.1.2", "aisubtech_name": "Tool Poisoning", "scanner_category": "SUSPICIOUS CODE EXECUTION", "meta_validated": true, "meta_confidence": "HIGH", "meta_confidence_reason": "Lack of version pinning is a real supply chain security issue. Without pinning, users could receive malicious updates. This is a standard security best practice for any dependency that handles credentials.", "meta_exploitability": "Medium - Requires compromised npm package or malicious maintainer", "meta_impact": "Critical - Full account compromise and fund loss" } }, { "id": "llm_finding_hyperliquid_2", "rule_id": "LLM_RESOURCE_ABUSE", "category": "resource_abuse", "severity": "HIGH", "title": "Persistent Background Server with Unbounded Resource Consumption", "description": "The skill starts a persistent background server ('hl server start') that maintains WebSocket connections and in-memory caching indefinitely. There are no documented resource limits, timeout configurations, or automatic cleanup mechanisms. The server could consume excessive memory/CPU, create zombie processes, or maintain stale connections. Users may forget to stop the server, leading to resource leaks.", "file_path": "SKILL.md", "line_number": null, "snippet": "Instructions: 'hl server start' with 'Persistent WebSocket connections' and 'In-memory caching'\n\nNo timeout limits mentioned\nNo automatic cleanup or resource bounds\nNo monitoring of resource consumption", "remediation": "1. Implement automatic server shutdown after inactivity periods. 2. Add resource limits (max memory, max connections). 3. Implement health checks and automatic restart on failure. 4. Add monitoring commands to check resource usage. 5. Warn users to stop the server when done. 6. Implement automatic cleanup of stale connections.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill presents CRITICAL security risks due to its requirement for users to provide private keys that control real financial assets. The skill installs and executes an unverified third-party binary (hyperliquid-cli) with full access to trading credentials, creating significant potential for fund loss through bugs, malicious updates, or supply chain attacks. The lack of version pinning, integrity verification, and security auditing compounds these risks. Additionally, the persistent background server and unencrypted local credential storage introduce further vulnerabilities. While the skill may provide legitimate trading functionality, the security architecture is fundamentally flawed for handling financial credentials. Users should exercise extreme caution and only use this skill with test accounts or minimal funds until security improvements are implemented.", "primary_threats": [ "Data Exfiltration/Credential Exposure", "Tool Exploitation via Unverified Binary", "Resource Exhaustion via Persistent Server", "Inadequate Input Validation", "Missing Security Disclosures" ], "aitech": "AITech-13.3", "aitech_name": "Availability Disruption", "aisubtech": "AISubtech-13.3.2", "aisubtech_name": "Compute Exhaustion", "scanner_category": "RESOURCE ABUSE", "meta_validated": true, "meta_confidence": "MEDIUM", "meta_confidence_reason": "This is a legitimate concern about resource management, but it's a standard pattern for trading CLIs that need low-latency connections. The risk is moderate - forgotten servers waste resources but don't directly cause security breaches. The underlying CLI likely has its own resource limits.", "meta_exploitability": "Low - Requires user forgetting to stop server", "meta_impact": "Low - Resource waste, not a security breach" } }, { "id": "llm_finding_hyperliquid_5", "rule_id": "LLM_SOCIAL_ENGINEERING", "category": "social_engineering", "severity": "MEDIUM", "title": "Missing Critical Security Warnings in Description", "description": "The skill description emphasizes trading capabilities and performance ('sub-5ms low-latency high-frequency trading') but fails to warn users about the critical security risks of providing private keys to third-party binaries. The description markets the skill as a trading tool without adequate disclosure of the financial risks, credential exposure, or potential for fund loss.", "file_path": "SKILL.md", "line_number": null, "snippet": "Description: 'Trade crypto, stocks... sub-5ms low-latency high-frequency trading'\n\nNo warnings about private key risks\nNo mention of financial loss potential\nNo security disclaimers\nEmphasis on performance over security", "remediation": "1. Add prominent security warnings in the description. 2. Disclose that private keys are required and the associated risks. 3. Warn about potential for complete fund loss. 4. Add disclaimer about third-party binary trust requirements. 5. Recommend starting with small amounts or testnet.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "This skill presents CRITICAL security risks due to its requirement for users to provide private keys that control real financial assets. The skill installs and executes an unverified third-party binary (hyperliquid-cli) with full access to trading credentials, creating significant potential for fund loss through bugs, malicious updates, or supply chain attacks. The lack of version pinning, integrity verification, and security auditing compounds these risks. Additionally, the persistent background server and unencrypted local credential storage introduce further vulnerabilities. While the skill may provide legitimate trading functionality, the security architecture is fundamentally flawed for handling financial credentials. Users should exercise extreme caution and only use this skill with test accounts or minimal funds until security improvements are implemented.", "primary_threats": [ "Data Exfiltration/Credential Exposure", "Tool Exploitation via Unverified Binary", "Resource Exhaustion via Persistent Server", "Inadequate Input Validation", "Missing Security Disclosures" ], "aitech": "AITech-2.1", "aitech_name": "Social Engineering", "aisubtech": null, "aisubtech_name": null, "scanner_category": "SOCIAL ENGINEERING", "meta_validated": true, "meta_confidence": "HIGH", "meta_confidence_reason": "The description does lack security warnings, which is a legitimate concern for a financial trading tool. Users should be warned upfront about the risks before installing.", "meta_exploitability": "N/A - This is a disclosure issue, not a direct vulnerability", "meta_impact": "Medium - Users may not understand risks before providing credentials" } } ], "scan_duration_seconds": 51.52519345283508, "duration_ms": 51525, "analyzers_used": [ "static_analyzer", "behavioral_analyzer", "llm_analyzer", "trigger_analyzer", "meta_analyzer" ], "timestamp": "2026-02-06T03:15:11.167730" }