ClawHub

Hyperliquid Trading Agent

v2.3.8

Autonomous Hyperliquid trading agent powered by smart money signals. Create, backtest, and deploy AI trading agents that track 500+ whale wallets on Hyperliq...

⭐ 16· 1.4k·2 current·4 all-time
byPhu Trinh@phutt-bwai
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
stale
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description, required binary (python3), and required env var (ZONEIN_API_KEY) match the code and SKILL.md. The script only contacts the ZoneIn API (https://mcp.zonein.xyz) and uses the API key as the primary credential. There are no unrelated env vars, binaries, or config paths requested.
ℹ
Instruction Scope
SKILL.md and scripts direct the agent to call the bundled CLI (scripts/zonein.py) which makes authenticated requests to the ZoneIn API and reads ~/.openclaw/openclaw.json as an API-key fallback. Financial actions are programmatically gated behind a --confirm flag in the script (documented). Note: because the skill can execute trading commands (agent-deploy, agent-open, agent-withdraw, etc.), granting it the API key enables live trading operations — the gating helps but the agent or integrator could invoke commands with --confirm.
✓
Install Mechanism
No installer or downloaded artifacts; this is effectively instruction + a Python script included in the skill bundle. Nothing is downloaded at install-time and no archives or third-party installers are referenced.
ℹ
Credentials
Only ZONEIN_API_KEY is required, which is appropriate for a client that calls the ZoneIn API. However this single key is high-sensitivity: if it has trading/withdrawal privileges on the ZoneIn account, the skill (or anyone who can invoke it with --confirm) could execute financial actions. The skill reads the key from environment or ~/.openclaw/openclaw.json as documented.
✓
Persistence & Privilege
always is false and the skill does not request elevated platform privileges or to modify other skills. It can be invoked autonomously (platform default), which is expected for an agent skill that can run agents — combine this with the note above about the API key when deciding to enable autonomous invocation.
Assessment
This skill appears internally consistent for a trading agent, but before enabling it consider: (1) Only provide a ZoneIn API key with the minimum scopes needed (prefer read-only or no-withdraw if testing). (2) Prefer HITL (human-in-the-loop) or paper-trading modes instead of fully automated 'auto' execution until you trust behavior. (3) Confirm the API base (mcp.zonein.xyz) and homepage (zonein.xyz) match official ZoneIn documentation and reputation. (4) Be aware the skill will use any ZONEIN_API_KEY found in your environment or ~/.openclaw/openclaw.json — avoid storing high-privilege keys in plaintext. (5) Review the bundled scripts (scripts/zonein.py) and sample configs (references/) yourself; rotate the key immediately if you suspect misuse. (6) If you need stronger safety, request an API key that cannot withdraw funds and test via backtests/paper trading first.

Like a lobster shell, security has layers — review code before you run it.

latestvk975y37tya02z1s879cn8qbhk1844z65

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🧠 Clawdis
Binspython3
EnvZONEIN_API_KEY
Primary envZONEIN_API_KEY

Comments