Nautilus Trader

NautilusTrader algorithmic trading platform for strategy development and live trading. Use when building trading strategies, backtesting, or deploying to Hyp...

Key points to consider before installing/using this skill: - The skill explicitly asks you to provide HYPERLIQUID_PK (a raw private key) and HYPERLIQUID_VAULT in a .env, but the registry metadata declares no required environment variables — that mismatch reduces transparency. - The package includes executable Python files (a 'patch' module and live-trading examples) that the agent is instructed to import and run; review those files (hyperliquid_patch.py, live_trading.py, set_leverage.py) line-by-line before running. - The pre-scan found unicode control characters in SKILL.md, which can hide or obfuscate content; inspect the raw files for hidden characters or injected instructions. - If you plan to use live trading: never use a real private key until you fully audit the code. Prefer testnet keys, a signing service, or an external signer/hardware wallet rather than placing raw private keys in .env. - Ask the publisher for provenance (homepage, source repo, release signing). Lack of a homepage and unknown source increases risk. - If you still want to test: run the skill in an isolated environment (air-gapped or VM), use ephemeral/testnet credentials, and monitor network calls. If the skill will be allowed to act autonomously, restrict that capability until you validate behavior. - Additional useful artifacts to request or check: full contents of hyperliquid_patch.py and set_leverage.py, any network endpoints used by the patch, and how the patch modifies NautilusTrader internals.

Type: OpenClaw Skill Name: nautilus-trader Version: 0.1.0 The skill is designed for algorithmic trading on Hyperliquid, which inherently involves high-risk operations like handling cryptocurrency private keys and executing live trades. The `SKILL.md` and Python scripts (`references/hyperliquid_patch.py`, `references/live_trading.py`, `references/set_leverage.py`) transparently request and use `HYPERLIQUID_PK` and `HYPERLIQUID_VAULT` from environment variables to interact with the legitimate Hyperliquid API. The `hyperliquid_patch.py` file implements a monkey-patch to fix known bugs in the Nautilus Trader's Hyperliquid adapter (serialization and price precision issues), which is a vulnerability *fix* for a third-party library, not a malicious act by the skill itself. All actions, including the use of broad `Bash` permissions for `pip install` and script execution, are directly aligned with the stated purpose of enabling live trading and strategy development, without any evidence of intentional harmful behavior or prompt injection attempts against the agent.