hyperliquid-setup
Fail
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill specifies the installation of "hyperliquid-python-sdk" from PyPI and "@nktkas/hyperliquid" and "viem" from NPM. These are well-known and legitimate libraries for interacting with the Hyperliquid exchange and the Ethereum ecosystem.
- [COMMAND_EXECUTION]: The skill uses standard shell commands to install dependencies, verify Python and Node.js versions, and check connectivity to the official Hyperliquid API endpoints. All commands are transparent, serve the stated purpose of setting up a trading environment, and do not involve piped remote script execution.
- [SAFE]: The skill handles sensitive API keys using established security best practices. It instructs the user to provide keys through a secure secret store or a restricted local file (chmod 600), warns against sharing keys in chat or logs, and uses the keys only for local signing via official SDKs. The URLs identified by automated scanners are the legitimate endpoints for the Hyperliquid testnet and are required for the skill's intended functionality.
Recommendations
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata