← Back to Skills Marketplace
809
Downloads
2
Stars
0
Active Installs
8
Versions
Install in OpenClaw
/install perp-lobster
Description
Trade on Hyperliquid DEX with simple commands. Place market/limit orders on perps, or run automated bots (market making, grid trading) with a web dashboard.
Usage Guidance
What to consider before installing/using Perp Lobster:
- This skill will clone and run code from https://github.com/ThisNewMark/perplobster and asks you to run its setup.sh (which installs packages). Do not run setup.sh without reviewing its contents.
- The project requires you to put a private key (HL_SECRET_KEY) into perplobster/.env on your machine. The skill states it will not ask you to paste keys into chat and will not read the .env file; however, the project scripts will access that file when they run. Use an account/subaccount with minimal funds and limited permissions.
- Before approving any script execution, inspect the scripts referenced (setup.sh, scripts/trade.py, start.sh, approve_builder_fee.py). The SKILL.md recommends doing this (cat file) — follow that guidance every time.
- Prefer running the code in an isolated environment (VM or container) and not on a machine with other sensitive keys or tokens. Consider creating a new wallet/subaccount specifically for bots.
- Verify the GitHub repo: check commit history, contributors, and issues to confirm it is the expected project and not a typo-squatted/malicious fork.
- If you want stronger safety, avoid enabling autonomous invocation for this skill (require user confirmation for all actions) and do not store high-value keys on the same host.
- The registry metadata does not declare the required local .env keys; treat that as a documentation gap and do not assume the skill has no credential needs.
Capability Analysis
Type: OpenClaw Skill
Name: perp-lobster
Version: 1.0.7
The skill is classified as suspicious due to its reliance on downloading and executing code from an external GitHub repository (`git clone https://github.com/ThisNewMark/perplobster.git`) for financial trading operations. While the `SKILL.md` includes good security practices like explicit instructions not to handle private keys in chat, requiring user approval for `setup.sh`, and transparent command execution, the fundamental act of fetching and running arbitrary scripts from a remote source introduces a significant supply chain vulnerability and potential for remote code execution if the external repository were compromised. There is no evidence of intentional malicious behavior within the provided skill bundle itself, but the high-risk capabilities and external dependency warrant a 'suspicious' classification.
Capability Assessment
Purpose & Capability
Name/description match the instructions: this is a trading assistant for Hyperliquid that clones a public GitHub repo and runs its Python scripts to trade or run bots. The only mismatch is that the registry metadata declares no required env vars/credentials, while the SKILL.md instructs the user to populate perplobster/.env with HL_ACCOUNT_ADDRESS and HL_SECRET_KEY (a private key). This is coherent for the stated purpose but the metadata omission is noteworthy.
Instruction Scope
SKILL.md instructs the agent to run shell commands (git clone, source a virtualenv, run python scripts, start/stop bots). It also instructs the agent to cat setup.sh and other scripts and to get explicit user approval before executing setup scripts or placing trades. That is appropriate for this purpose, but giving the agent the ability to execute arbitrary repo scripts is powerful — the skill mitigates this by requiring user confirmation and showing scripts before execution.
Install Mechanism
No formal install spec in the registry, but the instructions ask to run the project's setup.sh which will create a venv and install dependencies (likely from PyPI). This is expected for installing a Python project, but it means code and packages will be downloaded and executed locally — review setup.sh and requirements before running.
Credentials
The skill runtime expects a local .env containing HL_ACCOUNT_ADDRESS and HL_SECRET_KEY (private key), yet the registry metadata lists no required environment variables or primary credential. The SKILL.md explicitly forbids asking users to paste private keys into chat and forbids the agent from reading .env, which is good practice; however, the mismatch between declared metadata and instructions could lead users to overlook the sensitive local credential requirement. Also, running the provided scripts gives those scripts access to the private key on disk — that's necessary for trading but high-sensitivity and should be scoped to a limited/subaccount wallet.
Persistence & Privilege
The skill is not force-enabled (always:false) and is user-invocable. It does not request persistent platform privileges or attempt to modify other skills. Autonomous invocation is allowed by default but not unusual; combine that with the skill's ability to run trades only after user confirmation per SKILL.md.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install perp-lobster - After installation, invoke the skill by name or use
/perp-lobster - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.7
perplobster 1.0.7
- Initializes repo metadata and functionality as described in SKILL.md.
- Minor metadata adjustments in SKILL.md: removed 'requires' from the 'openclaw' metadata.
- No code or core logic changes; only a .DS_Store file was added.
- No impact on user functionality or setup.
v1.0.6
No major code changes; skill docs and usage instructions updated.
- Streamlined and clarified user instructions for trading and bot setup.
- Bot and trade commands are unchanged, but configuration, safety, and setup flows are shorter and clearer.
- Emphasizes confirming with the user before running risky or setup commands.
- Now highlights builder fee approval as a distinct step after credential setup.
- Minor updates: shows how to add leverage or subaccount to trades, and specifies which tools and env variables are required.
- Audience guidance and warnings remain the same; no impact on existing bots.
v1.0.5
No major code changes; skill docs and usage instructions updated.
- Streamlined and clarified user instructions for trading and bot setup.
- Bot and trade commands are unchanged, but configuration, safety, and setup flows are shorter and clearer.
- Emphasizes confirming with the user before running risky or setup commands.
- Now highlights builder fee approval as a distinct step after credential setup.
- Minor updates: shows how to add leverage or subaccount to trades, and specifies which tools and env variables are required.
- Audience guidance and warnings remain the same; no impact on existing bots.
v1.0.4
**Changelog for perplobster v1.0.4**
- Now executes trading and setup commands directly, instead of just instructing the user.
- Added output of `cat setup.sh` during setup for transparency.
- Users must still enter their own API credentials in `.env`—never share private keys in chat.
- Updated safety and security guidance, emphasizing never to read, echo, or display sensitive files.
- Expanded troubleshooting section and improved step-by-step setup automation.
v1.0.3
Minor fix:
Created standalon check_market.py script for organization.
v1.0.2
**Major update: adds instant trading and simplified bot controls with quick commands.**
- Introduced quick `/perplobster` commands for instant trading and bot control (long/short, close, grid start/stop, status).
- Added help command and command parsing instructions for easier usage.
- Kept all safety and security warnings; clarified no private keys in chat.
- Maintained full setup guide and advanced config instructions.
- Removed requirement lists from metadata for a lighter manifest.
- Existing bot and dashboard setups remain supported.
v1.0.1
Fix: Added explicit "NEVER ask the user to paste their private key in chat" rule + tells user to edit .env directly with a text editor
Added homepage in both frontmatter and metadata
v1.0.0
Initial release - Automated Hyperliquid trading. Bots include - perp Market Maker, Spot Market Maker, grid trader / volume farmer. All bots come with web dashboard. Ideal for crypto perps trading with openclaw.
Metadata
Frequently Asked Questions
What is Perp Lobster?
Trade on Hyperliquid DEX with simple commands. Place market/limit orders on perps, or run automated bots (market making, grid trading) with a web dashboard. It is an AI Agent Skill for Claude Code / OpenClaw, with 809 downloads so far.
How do I install Perp Lobster?
Run "/install perp-lobster" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Perp Lobster free?
Yes, Perp Lobster is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Perp Lobster support?
Perp Lobster is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Perp Lobster?
It is built and maintained by Vibetrade (@thisnewmark); the current version is v1.0.7.
More Skills