by 安全扫描
OpenClaw
安全
high confidenceThe skill's code, files, and runtime instructions are coherent with a DeFi wallet/lending tool; it does not request unrelated credentials or hidden network exfiltration, but it will create and store a plaintext private key file and requires installing npm dependencies and using an external RPC node — both are normal for this kind of tool and need user caution.
评估建议
This skill appears to be what it says: a CLI wallet/DeFi client for HyperEVM. Before installing or running it, consider the following: 1) The setup script will generate and store your private key in plaintext at ~/.hyperliquid-wallet.json (file mode 600). Treat that file as extremely sensitive — do not use your main funds without testing first. 2) npm install will pull dependencies from the public registry (viem and others); only run npm install if you trust the source. 3) The scripts talk to th...详细分析 ▾
✓ 用途与能力
Name/description match the code and scripts: all files implement deposit/withdraw/borrow/repay/position/health flows against HyperEVM markets. Required binary (node) is appropriate. No unrelated environment variables or cloud credentials are requested.
ℹ 指令范围
SKILL.md explicitly instructs cloning the repo and running npm install and the provided node scripts. The runtime instructions and scripts operate only against the blockchain RPC and local wallet file; they do not attempt to read unrelated system files or send data to unexpected external endpoints. They do, however, create and read a wallet private key file (~/.hyperliquid-wallet.json) and will sign/send transactions when run with the --yes flag.
ℹ 安装机制
There is no platform install spec, but SKILL.md requires git clone and npm install. Dependencies come from the public npm registry (viem and its deps). This is a reasonable and expected install method for a Node-based blockchain tool, but pulling npm packages is a moderate-risk action and should be done from a trustworthy network and registry.
ℹ 凭证需求
The skill requests no environment credentials. It does implicitly use process.env.HOME to build a wallet path and writes a plaintext private key JSON file (~/.hyperliquid-wallet.json) protected with chmod 600. Storing a private key on disk is expected for a CLI wallet but is high-sensitivity: anyone with file access or a malicious process could read it. The skill code itself does not contain logic that exfiltrates the private key to other hosts.
✓ 持久化与权限
The skill does not request always:true and does not alter other skills or system-wide settings. It creates a wallet file under the user's home directory and uses it to sign transactions — expected behavior for a wallet client.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/13
Initial publish — DeFi lending on Hyperliquid
● 无害
安装命令
点击复制官方npx clawhub@latest install hypurrfi
镜像加速npx clawhub@latest install hypurrfi --registry https://cn.longxiaskill.com