Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed read-only Hyperliquid account lookup skill; users should mainly consider wallet-address and portfolio privacy before using it.
Install only if you are comfortable with a configured or supplied wallet address being sent through ClawdBot infrastructure to Hyperliquid so account and position data can be retrieved. Consider using explicit Hyperliquid wording when invoking it, especially if you have other crypto or portfolio skills installed.
The trigger phrase "my perp positions" is relatively generic and could overlap with requests about perpetual positions on other exchanges or tools, not specifically Hyperliquid. The manifest does not provide exclusion conditions or clarifying constraints to narrow when this skill should activate versus other crypto or portfolio skills.
The skill transmits a wallet address to an external service chain via ClawdBot's internal API and ultimately to Hyperliquid's public API. While wallet addresses are public identifiers and the skill is read-only, this still exposes potentially sensitive portfolio-interest metadata and user-linked financial context to third-party infrastructure, especially if a default wallet from environment variables is queried without explicit user confirmation.
Upstream API (called by ClawdBot):
POST https://api.hyperliquid.xyz/info
The phrase "check my HL account" relies on shorthand that may be ambiguous and could refer to contexts other than Hyperliquid, especially if "HL" has multiple meanings in a broader assistant environment. The trigger section does not include negative examples or additional constraints to disambiguate activation.
No suspicious patterns detected.