aicoin-hyperliquid
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The file
lib/defaults.jsoncontains a hardcodedaccessKeyIdandaccessSecret. These are documented as a public free-tier key pair provided by the vendor for fallback use. - [EXTERNAL_DOWNLOADS]: The skill makes network requests to
https://open.aicoin.comto fetch market data and whale analytics from the vendor's official API. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by processing external data from API responses.
- Ingestion points: API responses from
open.aicoin.comare processed inlib/client.mjsand returned to the agent. - Boundary markers: The skill does not use specific delimiters or warnings to prevent the agent from following instructions embedded in the API data.
- Capability inventory: The skill can execute Node.js commands, perform network fetches, and write to local configuration files.
- Sanitization: No sanitization or filtering of the external data is performed before it is presented to the agent.
Audit Metadata