hyperliquid-supurr
Pass
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill manages Hyperliquid API wallet private keys via the
supurr initcommand. These credentials are required for transaction signing and are stored locally in the~/.supurr/credentials.jsonfile. This behavior is standard for non-custodial trading applications. - [REMOTE_CODE_EXECUTION]: The README and installation scripts provide commands that pipe remote scripts to bash (
curl -fsSL https://cli.supurr.app/install | bash). These endpoints are controlled by the skill author (supurr-app) and are used to install the CLI and engine binaries. - [EXTERNAL_DOWNLOADS]: The
install.shscript downloads platform-specific binaries for the CLI and the backtest engine fromhttps://cli.supurr.app/releases. This is the primary distribution method for the tool. - [COMMAND_EXECUTION]: The skill facilitates a development workflow that executes
cargo buildto compile custom strategies from source and runs the resulting binaries for local testing and deployment. - [COMMAND_EXECUTION]: The installer script modifies system shell configuration files (such as
.zshrcor.bashrc) to append the~/.supurr/bindirectory to the user's PATH environment variable, ensuring thesupurrcommand is globally available.
Audit Metadata