aicoin-hyperliquid

Warn

Audited by Runlayer on Mar 11, 2026

Risk Level: MEDIUM
Scan Summary
Max Score
89%
Files
6
Flagged
3
Chunks
7
Flagged Files (3)
aicoin-hyperliquid/lib/aicoin-api.mjsMEDIUM
88.9%

Risky tool definition detected

Tool: aicoin-hyperliquid/lib/aicoin-api.mjs Description: #!/usr/bin/env node // AiCoin API client with HMAC signing - shared lib import { createHmac, randomBytes } from 'node:crypto'; import { readFileSync, existsSync } from 'node:fs'; import { fileURLToPath } from 'node:url'; import { dirname, resolve } from 'node:path'; // Auto-load .env files (OpenClaw exec may not inject env vars into child processes) function loadEnv() { const candidates = [ resolve(process.cwd(), '.env'),

aicoin-hyperliquid/lib/defaults.jsonMEDIUM
88.1%

Risky tool definition detected

Users can replace with their own key via env vars.", "accessKeyId": "ronJ8uI0Yj2soAfGVs5H1YALUIINbE22", "accessSecret": "CWHZcH2us1CLSE7grroR1TpS0Z1JxTwU" }

aicoin-hyperliquid/SKILL.mdMEDIUM
86.6%

Risky tool definition detected

**MUST tell the user**: AiCoin API Key 仅用于获取 Hyperliquid 链上分析数据,无法进行任何交易操作。如需在 Hyperliquid 上交易,需要单独配置钱包私钥(见 aicoin-trading skill)。所有密钥仅保存在你的本地设备 `.env` 文件中,不会上传到任何服务器。

Passed Files (3)Click to expand
aicoin-hyperliquid/package.jsonOK
20.7%

Tool passed security scan

aicoin-hyperliquid/scripts/hl-trader.mjsOK
13.0%

Tool passed security scan

aicoin-hyperliquid/scripts/hl-market.mjsOK
8.9%

Tool passed security scan

Audit Metadata
Max File Score
89%
Classification
KNOWN_SERVER_KNOWN_TOOL_LIST
Files Scanned
6
Files Flagged
3
Chunks Analyzed
7
Analyzed
Mar 11, 2026, 02:54 PM
Security Audit — runlayer — aicoin-hyperliquid