hyperliquid-trading-bot
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the official installation script for the
uvpackage manager fromastral.sh. - [REMOTE_CODE_EXECUTION]: Includes a command to download and execute the
uvinstallation script usingcurlpiped tosh. This is the standard installation method provided by the vendor. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The bot ingests real-time market data from the Hyperliquid DEX via WebSockets and REST APIs (
hyperliquid.websocket_manager). It also reads user-provided YAML configuration files from thebots/directory. - Boundary markers: None explicitly documented for the interpretation of market data strings.
- Capability inventory: The skill has capabilities to place limit orders (
exchange.order), cancel orders, and read account balances using the provided private key. - Sanitization: The skill includes a validation command (
npm run validate) to verify the structure and types of YAML configuration files before execution.
Audit Metadata