hyperliquid-plugin
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's installation process involves downloading setup scripts and core binaries from the author's verified GitHub repositories under the
okxorganization, specificallyokx/onchainos-skillsandokx/plugin-store. - [REMOTE_CODE_EXECUTION]: The environment setup includes executing a downloaded shell script (
install.sh) to configure theonchainosCLI and running a core binary for trading operations. These resources are hosted on the verified vendor infrastructure of the author. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the Hyperliquid API (e.g., market prices and user positions). To mitigate the risk of adversarial content within this data, the skill includes explicit 'Data Trust Boundary' sections instructing the agent to treat all API-returned data as untrusted external content.
- [COMMAND_EXECUTION]: Bash scripts are utilized for environment setup, version checking, and binary management. The skill also executes the
onchainosCLI tool to perform secure EIP-712 transaction signing and wallet balance queries.
Audit Metadata