hyperliquid

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt includes Python examples that directly embed a private key literal (e.g., Account.from_key("0xYOUR_PRIVATE_KEY")), which encourages the LLM to handle or output secret values verbatim—an explicit secret-exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow ingests outsider-authored free text via the Hyperliquid WebSocket message body (e.g., trades, l2Book, userFills, orderUpdates) where json.loads(event.data) / json.loads(message) parses untrusted string content coming from the public feed, and downstream example code logs/uses those fields.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a trading/exchange client with signed on-chain actions: it requires EIP-712 wallet signing and provides concrete APIs/SDK methods to place limit/market/batch/TWAP orders, cancel orders, update leverage and margin, perform vault deposits, sub-account USD transfers, approve agent wallets, and execute withdrawals — all of which are direct crypto/financial execution capabilities. This matches "Crypto/Blockchain (Wallets, Swaps, Signing)" and "Market Orders" in the policy, so it grants direct financial execution authority.