Hyperliquid DEX Integration

ReviewAudited by ClawScan on May 1, 2026.

Overview

This is a coherent read-only Hyperliquid account lookup skill, with the main thing to notice being that wallet and financial position data flows through ClawdBot’s API.

This skill appears safe for read-only Hyperliquid lookups, but treat the queried wallet address and returned balances, positions, PnL, margin, leverage, and liquidation prices as sensitive financial information. Before installing, confirm you are comfortable with that data passing through the disclosed ClawdBot API path and verify any default TRADING_WALLET_ADDRESS is correct.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI07: Insecure Inter-Agent Communication

What this means

Your wallet address and Hyperliquid account details may be processed through ClawdBot’s API path when you use the skill.

Why it was flagged

The skill discloses that requests flow through ClawdBot infrastructure before reaching Hyperliquid; because the responses include balances, positions, PnL, margin, leverage, and liquidation prices, this is sensitive financial context even though it is purpose-aligned and described as read-only.

Skill content

User → ClawdBot Gateway → ClawdBot API Server → Hyperliquid Public API

Recommendation

Install only if you are comfortable sharing the queried wallet address and returned account/position information through the disclosed ClawdBot API flow.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may rely on a configured default wallet address even though the registry requirement summary does not list it.

Why it was flagged

The skill declares an optional default wallet address in SKILL.md, while the supplied registry requirements list no env var declarations. This is a disclosure/metadata mismatch, but the value is a wallet address rather than a secret and is directly related to the skill’s purpose.

Skill content

env:
  - name: TRADING_WALLET_ADDRESS
    description: Default wallet address to query (0x format)
    required: false

Recommendation

Review any configured TRADING_WALLET_ADDRESS value and make sure it is the wallet you intend the skill to query by default.