aicoin-hyperliquid
Pass
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: SAFECREDENTIALS_UNSAFEDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The file
lib/defaults.jsoncontains a hardcodedaccessKeyIdandaccessSecret. These are documented as public free-tier credentials provided by the vendor. - [DATA_EXFILTRATION]: The library
lib/aicoin-api.mjsis designed to read.envconfiguration files from multiple local paths, including~/.openclaw/workspace/.envand~/.openclaw/.env, to retrieve sensitive API keys. - [DATA_EXFILTRATION]: Authenticated data requests are sent to the vendor's API endpoint at
https://open.aicoin.com. - [COMMAND_EXECUTION]: The skill operates by executing Node.js scripts (
scripts/hl-market.mjsandscripts/hl-trader.mjs) which handle the communication with the remote API.
Audit Metadata