中文 EN

Scan Report

Scan New Files

✓ Trusted — Risk Score 5/100
Last scan:1 day ago Rescan
5 /100
vantage
Vantage — Autonomous trading agent for Hyperliquid perpetual futures. Signal-to-execution in one loop. Runs on your machine. No cloud infra.
Vantage is a legitimate autonomous trading agent for Hyperliquid perpetual futures. All observed behavior—private key signing, market data fetching, trade execution, and LLM decision integration—is directly declared, cryptographically sound, and consistent with documented purpose.
Skill Namevantage
Duration44.8s
Enginepi
✓
Safe to install
No action required. The skill is safe to use. Users should still protect their HYPERLIQUID_PRIVATE_KEY as they would any signing key.

Findings 1 items

Severity Finding Location
Low
NPM dependencies use unpinned version ranges Supply Chain
package.json uses caret ranges (^1.6.0, ^16.0.0, ^6.16.0, ^3.1.3) instead of exact pinned versions. This allows minor/patch updates to be auto-installed, creating a supply-chain attack window.
"axios": "^1.6.0", "dotenv": "^16.0.0", "ethers": "^6.16.0", "@msgpack/msgpack": "^3.1.3"
→ Pin dependencies to exact versions (e.g., "axios": "1.6.0") and update deliberately via npm audit.
 package.json:10
ResourceDeclaredInferredStatusEvidence
Filesystem NONE READ+WRITE ✓ Aligned src/hyperliquid.js:14 reads/writes data/paper-trades.json
Network READ READ+WRITE ✓ Aligned src/trader.js:159 POSTs signed orders to Hyperliquid exchange API; src/index.js:…
Shell NONE NONE — No shell/subprocess calls found
Environment READ READ ✓ Aligned process.env used for config only; no iteration over all env vars
Skill Invoke NONE NONE — No inter-skill invocation found
Clipboard NONE NONE — No clipboard access found
Browser NONE NONE — No browser automation found
Database NONE NONE — No database access found
19 findings
🔗
Medium External URL 外部 URL
https://ollama.com
README.md:212
🔗
Medium External URL 外部 URL
https://morebetterstudios.com/products
SKILL.md:17
🔗
Medium External URL 外部 URL
https://paulmillr.com/funding/
package-lock.json:41
🔗
Medium External URL 外部 URL
https://dotenvx.com
package-lock.json:131
🔗
Medium External URL 外部 URL
https://www.buymeacoffee.com/ricmoo
package-lock.json:204
💰
Medium Wallet Address 加密货币钱包地址
0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48
skills/thorchain-routing/SKILL.md:12
🔗
Medium External URL 外部 URL
https://thornode.ninerealms.com
skills/thorchain-routing/index.js:12
🔗
Medium External URL 外部 URL
https://midgard.ninerealms.com/v2
skills/thorchain-routing/index.js:13
🔗
Medium External URL 外部 URL
https://hyperliquid.gitbook.io/hyperliquid-docs/for-developers/api/info-endpoint
src/hyperliquid.js:5
🔗
Medium External URL 外部 URL
https://api.hyperliquid.xyz/info
src/hyperliquid.js:14
🔗
Medium External URL 外部 URL
https://api.coingecko.com/api/v3/simple/price?ids=thorchain&vs_currencies=usd&include_24hr_change=true&include_24hr_vol=...
src/research.js:22
🔗
Medium External URL 外部 URL
https://thornode.ninerealms.com/thorchain/network
src/research.js:30
🔗
Medium External URL 外部 URL
https://midgard.ninerealms.com/v2/pools?status=Available&order=volume24h&limit=$
src/research.js:37
🔗
Medium External URL 外部 URL
https://api.coingecko.com/api/v3/simple/price?ids=thorchain&vs_currencies=usd
src/setup-check.js:168
🔗
Medium External URL 外部 URL
https://midgard.ninerealms.com/v2/stats
src/setup-check.js:175
🔗
Medium External URL 外部 URL
https://midgard.ninerealms.com
src/signals.js:25
🔗
Medium External URL 外部 URL
https://api.coingecko.com/api/v3
src/signals.js:27
🔗
Medium External URL 外部 URL
https://api.hyperliquid.xyz/exchange
src/trader.js:22
💰
Medium Wallet Address 加密货币钱包地址
0x0000000000000000000000000000000000000000
src/trader.js:127

File Tree

16 files · 114.2 KB · 3239 lines
JavaScript 9f · 2357L JSON 3f · 444L Markdown 4f · 438L
├─ ▾ 📁 skills
│ ├─ ▾ 📁 thorchain-routing
│ │ ├─ 📜 index.js JavaScript 207L · 7.5 KB
│ │ ├─ 📋 package.json JSON 19L · 647 B
│ │ └─ 📝 SKILL.md Markdown 34L · 1.1 KB
│ └─ ▾ 📁 vantage
│ └─ 📝 SKILL.md Markdown 96L · 2.8 KB
├─ ▾ 📁 src
│ ├─ 📜 hyperliquid.js JavaScript 177L · 5.4 KB
│ ├─ 📜 index.js JavaScript 592L · 23.4 KB
│ ├─ 📜 research.js JavaScript 274L · 9.5 KB
│ ├─ 📜 setup-check.js JavaScript 278L · 12.1 KB
│ ├─ 📜 signals.js JavaScript 351L · 12.1 KB
│ ├─ 📜 sizing.js JavaScript 54L · 2.1 KB
│ ├─ 📜 thorchain.js JavaScript 77L · 2.2 KB
│ └─ 📜 trader.js JavaScript 347L · 11.2 KB
├─ 📋 package-lock.json JSON 424L · 14.6 KB
├─ 📋 package.json JSON 1L · 322 B
├─ 📝 README.md Markdown 212L · 6.5 KB
└─ 📝 SKILL.md Markdown 96L · 2.8 KB

Dependencies 4 items

PackageVersionSourceKnown VulnsNotes
axios ^1.6.0 npm No Caret range — minor version drift possible
dotenv ^16.0.0 npm No Caret range
ethers ^6.16.0 npm No Caret range
@msgpack/msgpack ^3.1.3 npm No Caret range

Security Positives

✓ No shell execution, subprocess calls, or system command invocation found
✓ No base64-encoded payloads, obfuscation, or eval() usage
✓ Private key is used only for cryptographic signing via ethers.js EIP-712; key is never logged or transmitted to any server
✓ All network calls are to documented, well-known public APIs (Hyperliquid, CoinGecko, THORChain Midgard/THORNode, Ollama/OpenAI)
✓ Paper trading mode is enforced when private key is absent, preventing accidental live trades during testing
✓ Input validation on private key format (0x-prefixed 64-char hex) prevents misuse of malformed keys
✓ No access to sensitive filesystem paths (~/.ssh, ~/.aws, .env file itself)
✓ Error sanitization strips private key from error messages before logging
✓ No hidden functionality or shadow behavior; code is readable and matches documentation