hyperliquid-perps
Warn
Audited by Snyk on Apr 29, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly a trading/investment integration for Hyperliquid with APIs that directly move/manage funds and execute market actions. It includes:
- POST /agent/trading/orders — place market/limit orders (perp & spot), with time-in-force and order grouping (executes trades).
- POST /agent/trading/transfer — transfer USDC between spot and perp accounts (moves user funds).
- POST /agent/trading/twap and DELETE /agent/trading/twap/:twapId — execute and terminate TWAP execution (automated trade execution).
- POST /agent/trading/leverage and POST /agent/trading/margin — change leverage and adjust margin (affects leveraged positions and collateral).
- GET /agent/trading/deposit-address — provide deposit address to fund the account (on‑ramp to move funds to Hyperliquid).
- Cancel/modify order endpoints (PUT /orders/:oid, DELETE /orders) — modify or cancel active financial orders.
These are specific financial execution capabilities (placing/canceling orders, transferring USDC, setting leverage/TWAP), not generic tool calls. Therefore it grants Direct Financial Execution Authority.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata