Trading Desk Incident Response

A step-by-step incident playbook for Hyperliquid trading desks covering unknown send results, unprotected positions, API outages and suspected key compromise.

AutomationAdvanced★ 263⑂ 54AI score 8/10Last updated: Nov 1, 2026

What it does

Defines an incident as any moment the exchange record and the desk's expectation disagree, then enforces a fixed reflex: stop adding, look, contain with approval, review.

Declaration format: INCIDENT INC-date-nn | time UTC | ticket id | symptom | owner, with the Desk Lead assigning ownership and pausing new proposals
Playbooks A–H: unknown send result, rejected order / partial fill, position mismatch, unprotected position, orphaned or stuck orders, exchange unreachable or rate limited, suspected API wallet compromise, daily loss stop
Containment rules: smallest reversible action, reduce don't flip, never resend "to make sure", never withdraw/transfer/bridge as a response
Verified reconciliation: orderStatus, openOrders, userFills, clearinghouseState, userRateLimit before any new risk resumes

Who it's for

Operators running automated or semi-automated order flow on Hyperliquid
Users of the companion hypergrok trading-desk skills in the same repo
Anyone who wants structural guardrails against an agent improvising during an outage

Examples

Send timed out: don't resend — query orderStatus by cloid, wait past the signed expiresAfter deadline, reconcile again, and only then consider an exact-nonce noop recovery ticket
IOC partially filled: the remainder is gone and normalTpsl children were never placed, so the filled size is unprotected — place a correctly sized protective stop at priority
Suspected key compromise: unfamiliar cloids or unapproved leverage changes trigger immediate user-side API wallet revocation, a full historicalOrders read, exposure assessment, secret-store key rotation, and a timeline review

· · · Install guide · · ·

Try it now, no install

Paste this into Claude to use the skill without installing anything.

Read the instructions in this file and follow them to help me:
https://raw.githubusercontent.com/galleonlabs/hypergrok-trading-desk/HEAD/skills/desk-incident-response/SKILL.md

What I want: (describe your task here)

If Claude can't open the link, open it yourself and paste the contents instead.

↓ If it works for you, download the ZIP below and install it. Then it runs on its own — no pasting each time.

Install in the Claude app (no terminal)

Download the ZIP with the button below.
In Claude, open Settings → Capabilities and turn on 'Code execution and file creation'. (one time)
Go to Customize → Skills → + → 'Upload a skill' and upload the ZIP.

↓ Download ZIP

Install in Claude Code

Let Claude do it — paste this into Claude Code

Install the skill I found on AI Skill Mart.
Copy the skills/desk-incident-response folder from the GitHub repo galleonlabs/hypergrok-trading-desk into my ~/.claude/skills/desk-incident-response/.
When it's done, tell me in one line what this skill can do.

Install with a command instead

git clone https://github.com/galleonlabs/hypergrok-trading-desk.git && cp -r hypergrok-trading-desk/skills/desk-incident-response ~/.claude/skills/

⚠ This is a third-party skill. Check the source repository before installing.

Open a terminal.
Clone the repo: git clone https://github.com/galleonlabs/hypergrok-trading-desk.git
Create the skills directory if needed: mkdir -p ~/.claude/skills
Copy this skill: cp -r hypergrok-trading-desk/skills/desk-incident-response ~/.claude/skills/
It references desk-execution-protocol, hyperliquid-api-reference, hyperliquid-websocket and desk-post-trade-review, so installing the whole set is safer: cp -r hypergrok-trading-desk/skills/* ~/.claude/skills/
Add a desk.md in your project describing standing approvals (protective stops), limits and escalation deadlines.
Restart Claude Code and validate the whole flow on testnet with a trade-only API wallet before touching real funds.

View source on GitHub ↗License: MIT