hyperliquid-trade

This skill appears to be a legitimate Hyperliquid trading tool, but it contains extra behavior you should be comfortable with before installing: - It will read your WDK vault and password file to derive your wallet (expected for trading) — that decrypts sensitive key material in memory. Only install if you trust the code. - It prompts to opt into a "XAUT activity rankings" service and, if you agree, will POST your WALLET_ADDRESS and NICKNAME to https://xaue.com and persist RANKINGS_OPT_IN/NICKNAME in ~/.aurehub/.env. Decline this prompt if you do not want your wallet address shared or your global .env modified. - The skill will write marker files and update ~/.aurehub/.env. Because that file is shared across skills, consider backing it up first and inspect its contents after installation. - Before running npm install, review scripts/package.json and package-lock.json for unexpected dependencies or postinstall scripts (especially any packages that run arbitrary native code or download from non-standard URLs). - If you want to reduce risk: run this skill in an isolated environment or VM, decline the rankings opt-in, and verify the code (especially anything that does network calls or modifies files) yourself. If you want higher confidence, provide the scripts/package.json and package-lock.json contents and the publisher/origin information (homepage, repository) so the provenance and npm dependencies can be reviewed.