hyperliquid
4 findings (1 critical, 2 high, 1 medium), mainly data exfiltration, unauthorized tool use, resource abuse. Most recent scan 2026-02-06.
This skill presents CRITICAL security risks due to its requirement for users to provide private keys that control real financial assets. The skill installs and executes an unverified third-party binary (hyperliquid-cli) with full access to trading credentials, creating significant potential for fund loss through bugs, malicious updates, or supply chain attacks. The lack of version pinning, integrity verification, and security auditing compounds these risks. Additionally, the persistent background server and unencrypted local credential storage introduce further vulnerabilities. While the skill may provide legitimate trading functionality, the security architecture is fundamentally flawed for handling financial credentials. Users should exercise extreme caution and only use this skill with test accounts or minimal funds until security improvements are implemented.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Trade crypto, stocks (AAPL, NVDA, TSLA), indexes, and commodities (GOLD, SILVER) 24/7 on Hyperliquid via HIP-3. Real-time position & P&L tracking, orderbook monitoring, multi-account management, and websocket client for sub-5ms low-latency high-frequency trading.
- Package
- 3 files, 28 KB
- SKILL.md
- 1034 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: Hyperliquid CLI Skill · What This Skill Does · Setup Instructions · 1. Check if CLI is Installed · 2. Verify Installation · 3. Set Up API Key for Trading · Follow the interactive prompts · Starting the Server (Recommended) · Key Innovations · HIP3 Traditional Assets · First, check available HIP3 markets and their coin values · Check Apple stock price (use the coin value from markets ls)
Findings
CRITICAL Hardcoded Private Key Requirement with Direct Trading Access Data Exfiltrationllm
The skill requires users to provide their HYPERLIQUID_PRIVATE_KEY as an environment variable, which grants full trading authority over the user's Hyperliquid account. This private key enables unlimited fund transfers, trades, and account control. The skill executes a third-party binary ('hl') that has direct access to this critical credential, creating significant risk of fund loss through bugs, malicious updates, or compromised dependencies.
SKILL.md
requires: {env: ['HYPERLIQUID_PRIVATE_KEY']}
Instructions state: 'Export the private key (starts with 0x)' and 'export HYPERLIQUID_PRIVATE_KEY=0x...your_private_key...'HIGH Unverified Third-Party Binary Execution with Financial Authority Unauthorized Tool Usellm
The skill installs and executes 'hyperliquid-cli' via npm, a third-party binary with full access to the user's trading private key. There is no verification of the binary's integrity, no pinned version specified, and no security audit mentioned. The binary runs with complete authority to execute trades, transfer funds, and manage positions. Users have no visibility into what the binary actually does with their credentials.
SKILL.md
install: ['npm install -g hyperliquid-cli']
No version pinning (e.g., hyperliquid-cli@1.2.3)
No integrity checks or signature verification
Binary has full access to HYPERLIQUID_PRIVATE_KEYHIGH Persistent Background Server with Unbounded Resource Consumption Resource Abusellm
The skill starts a persistent background server ('hl server start') that maintains WebSocket connections and in-memory caching indefinitely. There are no documented resource limits, timeout configurations, or automatic cleanup mechanisms. The server could consume excessive memory/CPU, create zombie processes, or maintain stale connections. Users may forget to stop the server, leading to resource leaks.
SKILL.md
Instructions: 'hl server start' with 'Persistent WebSocket connections' and 'In-memory caching'
No timeout limits mentioned
No automatic cleanup or resource bounds
No monitoring of resource consumptionMEDIUM Missing Critical Security Warnings in Description Social Engineeringllm
The skill description emphasizes trading capabilities and performance ('sub-5ms low-latency high-frequency trading') but fails to warn users about the critical security risks of providing private keys to third-party binaries. The description markets the skill as a trading tool without adequate disclosure of the financial risks, credential exposure, or potential for fund loss.
SKILL.md
Description: 'Trade crypto, stocks... sub-5ms low-latency high-frequency trading'
No warnings about private key risks
No mention of financial loss potential
No security disclaimers
Emphasis on performance over securityWhat is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 7.2 KB |
examples.md | doc | 10 KB |
reference.md | doc | 11 KB |
External hosts referenced
app.hyperliquid.xyz github.com your-webhook.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
OUTDIR HYPERLIQUID_PRIVATE_KEY
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/hyperliquid-cli
- Raw scan result: hyperliquid-cli-with-hip3-support-scan.json
- Badge for your README:
- Request a re-scan