Is Hl Spot X402 safe to install?

SaferSkills independently audited Hl Spot X402 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md2.6 KB · Markdown

Hyperliquid Spot API

Real-time spot market data for all 454 tokens on Hyperliquid L1 DEX. Prices, volume, wallet balances. Powered by x402 micropayments.

Native Hyperliquid data -- no CoinGecko, no aggregators. Direct from the L1 DEX API for maximum accuracy and speed.

Endpoints

`POST /api/tokens` - $0.002/call

List all 454 spot tokens with metadata.

// Request
{ "search": "PURR" }

// Response
{
  "tokens": [
    { "name": "PURR", "tokenId": "0xc4bf3f...", "index": 1, "decimals": 0, "weiDecimals": 8 }
  ],
  "count": 1
}

`POST /api/markets` - $0.002/call

Live spot market prices, 24h volume, and price changes.

// Request
{ "sort": "volume" }

// Response
{
  "markets": [
    {
      "name": "PURR/USDC",
      "coin": "PURR",
      "tokenId": "0xc4bf3f...",
      "markPx": "0.0234",
      "midPx": "0.0233",
      "prevDayPx": "0.0222",
      "dayNtlVlm": "1250000",
      "change24h": 5.41
    }
  ],
  "count": 120
}

`POST /api/balance` - $0.002/call

Spot token balances for a wallet address.

// Request
{ "address": "0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045" }

// Response
{
  "address": "0xd8dA...",
  "balances": [
    { "coin": "PURR", "token": 1, "total": "15000", "hold": "5000", "available": "10000", "entryNtl": "350.50" }
  ],
  "count": 1
}

Use Cases

Token discovery: Find which spot tokens are available on Hyperliquid before trading
Market scanning: Identify high-volume or trending spot pairs
Portfolio tracking: Check spot holdings for any Hyperliquid wallet
Trading bots: Get real-time prices for spot order execution
Analytics dashboards: Build Hyperliquid spot market overviews

MCP Integration

Works with Claude Desktop, Cursor, Copilot, and any MCP-compatible client.

{
  "mcpServers": {
    "hl-spot": {
      "url": "https://hl-spot-production.up.railway.app/mcp",
      "transport": "sse"
    }
  }
}

Payment

Uses x402 protocol. Send a request, get HTTP 402 with price, your agent signs USDC on Base automatically. No API keys, no signup.

Hyperliquid Data - Perps/futures market data (not spot)
HL Portfolio - Full Hyperliquid portfolio (perps + spot combined)
Token Price - CoinGecko-based token prices (CEX, not HL native)
Wallet Portfolio - Multi-chain wallet balances (EVM, not HL-specific)
HL Funding - Funding rates for Hyperliquid perps

Hl Spot X402— agent skill

Is Hl Spot X402 safe to install?

Hyperliquid Spot API

Endpoints

`POST /api/tokens` - $0.002/call

`POST /api/markets` - $0.002/call

`POST /api/balance` - $0.002/call

Use Cases

MCP Integration

Payment

Audit the pieces. Scan the whole. Decide.

Is Hl Spot X402 safe to install?

Hyperliquid Spot API

Endpoints

POST /api/tokens - $0.002/call

POST /api/markets - $0.002/call

POST /api/balance - $0.002/call

Use Cases

MCP Integration

Payment

Related APIs

Audit the pieces. Scan the whole. Decide.

`POST /api/tokens` - $0.002/call

`POST /api/markets` - $0.002/call

`POST /api/balance` - $0.002/call