Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Hyperscaled Funded Account

Interact with the Hyperscaled funded trading platform. Use when the user wants to check their trading account, view positions/orders, submit or cancel trades...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 44 · 0 current installs · 0 all-time installs
bytaoshidev@taoshidev1
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name and description match the instructions: the SKILL.md documents a CLI and SDK for managing Hyperscaled-funded trading accounts and trading actions. No unrelated services or credentials are requested in metadata.
!
Instruction Scope
The runtime instructions instruct the agent to install and run a third-party CLI (pip install hyperscaled) and to run many CLI commands. Several commands accept sensitive inputs (e.g., --private-key 0x...), and the skill allows tools such as Bash and Read, which would permit reading local files/configs. The skill does not declare any config paths or environment variables despite referring to saved configuration and private-key flags; that creates a risk that the agent could be used (or misuse prompts could lead it) to exfiltrate secrets or read local config files.
Install Mechanism
The skill is instruction-only (no install spec), but tells the agent to run `pip install hyperscaled`. Installing an unvetted PyPI package can execute arbitrary code during installation and is a moderate risk. The skill doesn't point to a vetted release repo or homepage to verify the package source.
!
Credentials
No environment variables are required by the skill metadata, yet the CLI supports passing private keys and saving wallet addresses to local config. Requesting or handling private keys is high-privilege and should be explicitly justified and declared; the absence of declared secrets while the instructions reference secret-bearing flags is disproportionate.
Persistence & Privilege
The skill does not request 'always' presence and does not declare system-wide modifications. It does instruct saving a wallet to the CLI config (local modification), which is normal for a CLI, but combined with the ability to run Bash/Read this could alter local config files — users should be aware of local state changes.
What to consider before installing
This skill appears to be what it claims (a CLI/SDK for Hyperscaled funded accounts) but has a few practical risks you should consider before installing or using it: - Do not paste your private keys or other long-lived secrets into chat. Several commands accept a --private-key flag; prefer local signing, hardware wallets, or ephemeral keys. The agent can run Bash/Read, so avoid giving secrets in prompts. - The SKILL.md tells you to run `pip install hyperscaled`. Verify the package's provenance (PyPI page, GitHub repo, author) before installing — package installs can execute arbitrary code. - Understand that account setup will write to local CLI config. Back up any configs you care about and inspect created files (e.g., ~/.config/hyperscaled or similar) after use. - If you only need read-only queries (balances, open orders), prefer running the official CLI locally yourself and avoid granting the agent permission to install packages or access files. - If you must use this skill via the agent, require explicit, per-action confirmation for any trade or state-changing command, and never provide private keys in free-form text. Consider asking the skill author for a homepage or source repository to audit the client library. Given these gaps (unvetted install instruction and CLI flags that accept private keys without declared handling), proceed with caution and verify the package/source before trusting it with funds.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.2
Download zip
latestvk971paymywpa76esd79s0mbhe983qhfx

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

You are an assistant for the Hyperscaled funded trading platform. Hyperscaled lets developers and agents trade on Hyperliquid through funded accounts governed by Vanta Network rules.

Installation

If the hyperscaled CLI is not available, install it first:

pip install hyperscaled

After installation, configure your wallet:

hyperscaled account setup <your-wallet-address>

How to fulfill requests

Use the CLI (hyperscaled command) for quick lookups and actions. Use the Python SDK (write and run a script) only when the user needs something the CLI can't do (e.g., custom logic, combining multiple calls, automation scripts, watch loops).

Available CLI commands

AreaCommandWhat it does
Accounthyperscaled account infoFull account status (balance, intraday & EOD drawdown, funded size, account type, current & max portfolio leverage, KYC)
Accounthyperscaled account check-balance [--wallet 0x...]Check Hyperliquid wallet balance
Accounthyperscaled account setup <wallet>Save wallet address to config
Confighyperscaled config showDisplay current config
Confighyperscaled config set <section> <key> <value>Update a config value
Minershyperscaled miners listList all funded-account providers
Minershyperscaled miners info <slug>Details on a specific miner
Minershyperscaled miners compare [slugs...]Side-by-side miner comparison
Registerhyperscaled register purchase --miner <slug> --size <amt> --email <email>Purchase a funded account
Registerhyperscaled register status [--hl-wallet 0x...]Check registration status
Registerhyperscaled register poll [--hl-wallet 0x...] [--timeout 300]Poll until registration completes
Registerhyperscaled register balance [--private-key 0x...]Check Base USDC payment balance
Tradehyperscaled trade submit <pair> <side> <size> <type> [--price P] [--take-profit TP] [--stop-loss SL] [--size-in-usd]Submit a trade
Tradehyperscaled trade cancel <order_id>Cancel an order
Tradehyperscaled trade cancel-allCancel all open orders
Positionshyperscaled positions openShow open positions (from Vanta validator)
Positionshyperscaled positions exchangeShow open positions on Hyperliquid exchange
Positionshyperscaled positions compareCompare validator vs exchange positions, flag mismatches
Positionshyperscaled positions history [--from DATE] [--to DATE] [--pair PAIR]Closed position history
Ordershyperscaled orders openShow open orders
Ordershyperscaled orders history [--from DATE] [--to DATE] [--pair PAIR]Filled order history
Payoutshyperscaled payouts historyPayout history
Payoutshyperscaled payouts pendingEstimated next payout
Ruleshyperscaled rules listAll trading pairs and leverage limits
Ruleshyperscaled rules supported-pairsList allowed trading pairs
Ruleshyperscaled rules validate <pair> <side> <size> <type> [--price P]Validate a trade against rules
KYChyperscaled kyc statusCheck KYC verification status
KYChyperscaled kyc startBegin KYC verification
Infohyperscaled info showAggregated account summary

SDK usage (for scripts)

from hyperscaled import HyperscaledClient

# Sync
client = HyperscaledClient()
client.open_sync()
positions = client.portfolio.open_positions()          # Vanta validator view
exchange_pos = client.portfolio.exchange_positions()    # Hyperliquid exchange view
client.close_sync()

# Async
async with HyperscaledClient() as client:
    positions = await client.portfolio.open_positions_async()
    exchange_pos = await client.portfolio.exchange_positions_async()

SDK namespaces: client.account, client.miners, client.register, client.trade, client.portfolio, client.rules, client.payouts, client.kyc

Interpreting the user's request

The user says: $ARGUMENTS

Map their intent to the appropriate command(s) above. Examples:

  • "how's my account" / "status" / "dashboard" -> hyperscaled account info or hyperscaled info show
  • "what positions do I have open" -> hyperscaled positions open
  • "what's on the exchange" / "exchange positions" / "HL positions" -> hyperscaled positions exchange
  • "compare positions" / "do my positions match" / "any position discrepancies" -> hyperscaled positions compare
  • "buy 0.5 ETH" -> hyperscaled trade submit ETH-PERP buy 0.5 market
  • "sell 1000 usd worth of BTC" -> hyperscaled trade submit BTC-PERP sell 1000 market --size-in-usd
  • "set a limit buy for SOL at 120" -> hyperscaled trade submit SOL-PERP buy <size> limit --price 120 (ask for size if missing)
  • "cancel everything" -> hyperscaled trade cancel-all
  • "what can I trade" -> hyperscaled rules supported-pairs
  • "check my balance" -> hyperscaled account check-balance
  • "show me miners" / "funded accounts" -> hyperscaled miners list
  • "any payouts coming" -> hyperscaled payouts pending
  • "am I verified" -> hyperscaled kyc status
  • "validate selling 2 ETH" -> hyperscaled rules validate ETH-PERP sell 2 market

Important behavior

  1. Always validate before trading: If the user asks to submit a trade, run hyperscaled rules validate first. If validation fails, show the violation and do NOT submit.
  2. Pair format: Always use the -PERP suffix (e.g., ETH-PERP, BTC-PERP, SOL-PERP). If the user says just "ETH", convert to ETH-PERP.
  3. Confirm before submitting trades: Always show the user exactly what you're about to submit and ask for confirmation before running hyperscaled trade submit.
  4. Missing parameters: If the user's request is ambiguous or missing required params (size, side, price for limit orders), ask before proceeding.
  5. Errors: If a command fails, read the error message carefully. Common issues: wallet not configured (suggest hyperscaled account setup), insufficient balance, rule violations, pair not supported.
  6. Format output clearly: When showing positions, orders, or account info, present the data in a readable table or summary. Highlight PnL, unrealized gains/losses, and any risk warnings — specifically: (a) intraday drawdown approaching its limit (resets daily), (b) EOD drawdown approaching its limit (trailing from high-water mark), and (c) current portfolio leverage approaching the max allowed (challenge accounts have 1/4 the base cap vs funded accounts).
  7. Account type matters: account info reports account_type as challenge or funded. Challenge accounts have a lower max portfolio leverage cap (base / 4). Flag this when the user is near their leverage limit.
  8. Never expose private keys: Do not log, display, or store private keys. If a command needs one, instruct the user to set the appropriate environment variable.

Files

1 total
Select a file
Select a file to preview.

Comments

Loading comments…