The Agent Skills Directory

[SAFE]: The skill interacts exclusively with official Hyperliquid API endpoints (api.hyperliquid.xyz and api.hyperliquid-testnet.xyz) for information retrieval and trade execution.
[SAFE]: Account identification is handled securely through the use of environment variables ($HYPERLIQUID_ACCOUNT_ADDRESS), avoiding hardcoded identifiers.
[SAFE]: Position management logic incorporates standard safety mechanisms, such as using reduce-only and IOC (Immediate-or-Cancel) orders to prevent accidental position reversals or unintended execution.
[DATA_EXPOSURE]: The skill accesses account-level financial data (positions, margin, PnL), which is necessary for its stated purpose of managing a trading account. This data is only sent to the authenticated exchange provider.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API responses (Hyperliquid exchange).
Ingestion points: Data enters via curl calls to clearinghouseState, meta, and frontendOpenOrders endpoints.
Boundary markers: Data is processed using structured parsing with jq and Python's JSON libraries.
Capability inventory: Subprocess calls are limited to curl and jq for API interaction; trading capabilities are scoped to the Hyperliquid SDK.
Sanitization: Standard JSON deserialization is used, and numeric values are explicitly cast (e.g., float(), round_sz()), reducing the risk of malicious payload execution.

hyperliquid-positions