Trust Assessment
hyperliquid received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Unpinned npm dependency version, Hardcoded absolute path for state file.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Hardcoded absolute path for state file The `scripts/check-positions.mjs` script attempts to write trading state data to a hardcoded absolute path (`/home/ana/clawd/trading-state.json`). This path is outside the skill's local directory and could lead to unauthorized file modification, data exfiltration, or denial of service if the skill is deployed in an environment where this path is sensitive or writable by an attacker. Skills should generally operate within their designated sandbox or use configurable paths for external storage. Modify `scripts/check-positions.mjs` to store state files within the skill's designated data directory or use a relative path within the skill's sandbox. Avoid hardcoding absolute paths, especially outside the skill's expected operational scope. If the file must be stored in a specific user-controlled location, ensure the path is configurable via a secure environment variable or a user-provided, validated input, and that the skill's runtime environment enforces appropriate sandboxing. | LLM | scripts/check-positions.mjs:10 | |
| MEDIUM | Unpinned npm dependency version Dependency 'ethers' is not pinned to an exact version ('^6.9.0'). Pin dependencies to exact versions to reduce drift and supply-chain risk. | Dependencies | skills/anajuliabit/hyperliquid-trading/scripts/package.json |
Scan History
Embed Code
[](https://skillshield.io/report/fff415f05511ecec)
Powered by SkillShield