use-hln-api-df6080 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited use-hln-api-df6080 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to interact with the Hyperliquid Names API through its public HTTP surface. Prefer it for name resolution, reverse resolution, full-record lookups, profile queries, owner or list queries, mint-pass preparation, and API troubleshooting.
Prefer concise, task-shaped answers. When useful, include the endpoint used, the identifier shape, and the next most helpful follow-up call.
Define the request before calling the API:
.hl domain, label, address, nameHash, or tokenId.Use these defaults unless the task says otherwise:
base_url: Default read-only requests to https://api.hlnames.xyz/. Use https://api.testnet.hlnames.xyz/ when the user asks for testnet. Use a local URL only when the user provides one.api_key: Send as X-API-Key on API requests. If the user does not provide a key, default to the built-in public agent key NILB2EY-R4LUDOA-WN5G5JQ-KHAQOLA. If the user provides a key, prefer that override. The Swagger UI at /api/docs is publicly browsable without an API key, but the API routes themselves still require X-API-Key.identifier: Use the correct identifier shape for the endpoint.Stay inside these non-goals unless the user explicitly asks and has the right access:
Use the narrowest public endpoint that answers the request.
Domain: use name.hl. Label: use name with no .hl suffix. Address: use a valid EVM address; checksum or lowercase is acceptable. NameHash: use 0x plus 64 hex chars. TokenId: use a numeric string.
Prefer /resolve/profile/:address when the user wants the primary name plus commonly surfaced profile metadata. Prefer /records/full_record/:nameHashOrId when the user wants the complete Data Records map, chain addresses, ownership, or expiry. Prefer /utils/namehash/:domain only when the user needs the hash itself.
For records/full_record, always distinguish data.records from data.chainAddresses: data.records is the user-controlled text metadata map, while data.chainAddresses is the structured address map by coin type. Read references/validation-and-errors.md when inputs are malformed or results are ambiguous.
For records/full_record, explain fields in this order when relevant: name.*, then data.records, then data.chainAddresses.
Use this quick routing map first:
nameHash from a domain: GET /utils/namehash/:domainnameHash or tokenId: GET /utils/registered/:nameHashOrIdGET /resolve/address/:domainGET /resolve/primary_name/:addressGET /resolve/profile/:addressGET /resolve/past_resolved/:domain or range variantGET /metadata/expiry/:nameHashOrIdGET /records/full_record/:nameHashOrIdGET /records/image/:tokenIdGET /records/coin_typesGET /utils/all_names, GET|POST /utils/all_primary_names, or GET /utils/names_owner/:addressPOST /sign_mintpass/:label when the developer is ready to continue promptly into the mint transactionRead references/endpoints.md for the full endpoint catalog, request shapes, and response notes. Read references/integration.md when the user is integrating HL Names into a HyperEVM dApp or wallet flow.
Apply these guardrails on every task:
POST /sign_mintpass/:label as a readiness check in a time-sensitive mint workflow. Request it when the developer is prepared to submit the mint transaction promptly, because the returned payload expires quickly.Happy path:
0x...?”GET /resolve/profile/:address.GET /records/full_record/:nameHashOrId.Full record interpretation:
full_record payload a fixed profile schema?”data.records is a user-controlled metadata map and may include suggested keys like Avatar, Twitter, Discord, Bio, REDIRECT, or custom app-specific keys.data.chainAddresses, which is the separate structured map of blockchain addresses by coin type.name.* first, then data.records, then data.chainAddresses.Failure path:
jeff.eth on HLN.”.hl domain before calling the API..hl names and suggest the corrected target if the user intended jeff.hl.422 Unprocessable Content.Load only what you need:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.