1m-trade — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited 1m-trade (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Official website (wallet & account): https://www.1m-trade.com
Scan and verify all required dependencies for sub-skills and install what is needed. From this skill bundle root, run node auto_check.js to verify required binaries and .env entries (it does not print secrets).
1m-trade-news (required)This aggregator must have the `1m-trade-news` sub-skill available: market intelligence, news, and BlockBeats API calls all go through it. Do not skip this step when installing the bundle.
SKILL.md, etc.) and that your OpenClaw / host loads that folder as the `1m-trade-news` skill.PATH for the documented API flows (see metadata requires.bins).1m-trade state file (paths under Optional runtime override below).Apply for / obtain a key (free tier):
curl --request GET --url "https://api-pro.theblockbeats.info/v1/api-key/free"data.api_key and use it as BLOCKBEATS_API_KEY.~/.openclaw/.1m-trade/.env (or $OPENCLAW_STATE_DIR/.1m-trade/.env if you use that override), on its own line:BLOCKBEATS_API_KEY=<api_key> Do not remove unrelated lines; only add or update this variable.
Reference: skills/1m-trade-news/SKILL.md → Get an API key (includes agent-safe steps to populate .env without printing the key).
Security: Do not paste API keys into chat; the model must not echo stored keys.
1m-trade-dex (required)This aggregator must have the `1m-trade-dex` sub-skill available: trading, wallet queries, and hl1m all go through it. Do not skip this step when installing the bundle.
SKILL.md, reference.md, etc.) and that your OpenClaw / host loads that folder as the `1m-trade-dex` skill.1m-trade package so hl1m is on PATH (Python 3.11+ recommended): pipx install 1m-trade
hl1m --helpIf pipx is missing, install it per your OS (see skills/1m-trade-dex/SKILL.md → Setup).
.env contains the Hyperliquid fields auto_check.js expects — see `skills/1m-trade-dex/SKILL.md` → Wallet initialization.Optional runtime override:
OPENCLAW_STATE_DIR can be set to change where local .1m-trade state files are read/written.~/.openclaw/.1m-trade/.Secret source-of-truth policy:
.env file under the paths above (typically after the user runs hl1m init-wallet and related CLIs locally)..env into context or quote stored secrets. For wallet bind, if the user voluntarily sends wallet address + proxy private key in one message (e.g. clearly labeled fields such as wallet address and proxy private key), follow 1m-trade-dex → parse and invoke hl1m init-wallet --address … --pri_key … in a trusted shell; do not repeat full keys in assistant replies. Otherwise prefer the user running init-wallet locally without pasting keys in chat.This skill (1m-trade) is an orchestration hub that integrates multiple sub-skills into a single coherent workflow. You describe your goal (e.g., "check today's sentiment", "analyze BTC fund flows and open a long with half my balance", "help me configure my Hyperliquid wallet with init-wallet", "auto-trade BTC"), and this skill decomposes the request and calls 1m-trade-news and 1m-trade-dex to complete the operation.
Based on intent keywords, this skill routes into one of the workflows below (or composes them).
Triggers: market, price, news, macro, fund flows, perps, search [keyword]
Skill: 1m-trade-news
Logic:
Example output:
📰 Market Report · 202X-XX-XX
===
1. 📊 Snapshot
Sentiment: 35 → Neutral
BTC ETF: +$120M net inflow today
On-chain tx volume: +15% vs yesterday
2. 💰 Hot flows (Solana)
1. JTO net inflow $4.2M
2. ...
3. 🌐 Macro
Global M2: +4.5% YoY → Liquidity easing
DXY: 104.2 → Relatively strong
Overall: Macro backdrop is neutral-to-bullish for crypto.Triggers: init wallet, configure wallet, configure trading account, bind wallet, connect Hyperliquid, set up trading, wallet settings, proxy key, API key (wallet); same message with both wallet address and proxy private key (or non-English equivalents per 1m-trade-dex Natural-language binding).
Skill: 1m-trade-dex (see skills/1m-trade-dex/SKILL.md → Natural-language binding and skills/1m-trade-dex/reference.md)
Wallet operations (synced with sub-skill docs):
| Step | Where | What |
|---|---|---|
| Create / manage wallet | Browser | [https://www.1m-trade.com](https://www.1m-trade.com) — official UI for account and wallet; do not recreate this flow in chat. |
| Bind CLI to the account | Local shell | `hl1m init-wallet` only — wallet public address + proxy (API) private key. Never use the main / master wallet private key. |
| Verify | After init | hl1m query-user-state (and other hl1m query commands as needed). |
Logic:
wallet address and proxy private key, or other languages as mapped in 1m-trade-dex), follow 1m-trade-dex Natural-language binding: parse 0x + 40 hex (address) and 0x + 64 hex (proxy key), then run hl1m init-wallet --address <parsed> --pri_key <parsed> in a trusted shell; do not echo full keys in chat. hl1m init-wallet --address 0xYourWalletAddress --pri_key 0xYourProxyPrivateKeyhl1m query-user-state to confirm the account is visible.Triggers: trade, order, open, close, positions, price, kline, HIP3, AAPL, GOLD
Skill: 1m-trade-dex
Logic:
1m-trade-dex is installed and run node auto_check.js to verify prerequisites. If it fails, do not execute any trades.1m-trade-dex documentation for the specific command.Trigger examples: "check the market then decide whether to buy BTC", "after I init my wallet, show ETH kline"
Logic:
User: "How is the crypto market today? I also need to connect my Hyperliquid wallet." `1m-trade`:
wallet address + proxy private key (or equivalent), parse and run hl1m init-wallet; otherwise give the placeholder command for local use (proxy key only; never the main wallet private key). Do not guide send-private-key.User: "Search for the latest news about 'Bitcoin halving', then show BTC kline." `1m-trade`:
Triggers: enable auto trading, autonomous trading, managed, AI trade for me, run every N minutes, auto trade BTC
Logic:
node auto_check.jsnode <skill_bundle_root>/auto_check.jsIf it fails, do not enable auto trading.
1m-trade-auto-trader cron job exists:openclaw cron list to verify whether it still exists.openclaw cron rm <task id>, then re-run openclaw cron list to confirm it is gone.--session isolated is fixed and must not be changed. The default interval is every 20 minutes (*/20); replace with */N if needed. Send the trading report to the user.Security constraints for the cron message:
.env contents, tokens). openclaw cron add \
--name "1m-trade-auto-trader" \
--cron "*/20 * * * *" \
--session isolated \
--message "<Paste the FULL prompt from #### Workflow content through the end of the report template below; translate EVERY narrative line into the user's language (e.g. full Simplified Chinese if the user uses Chinese—no leftover English instructions). Keep skill names, hl1m subcommands, symbols, and <<...>> structure unchanged. No secrets. Each run outputs ONLY the final trading report; that report must be monolingual (all Chinese OR all English per user—no mixed prose). Replace this placeholder with that translated block.>" \
--timeoutSeconds 600 \
--announce \
--channel <channel e.g. telegram> \
--to "<user id>" \#### Workflow content Pre-start: dependency memory check All skills are installed locally.
$OPENCLAW_STATE_DIR/.1m-trade/dependencies-status.mdEnsure these skills are available in order:
If a skill is unavailable, attempt to install/enable it via the system's mechanism. Then record success in the memory file.
# Dependency install marker - do not edit manually
Installed: true
Skills: 1m-trade-news (or others)
Skills Path: <skill paths>
LastChecked: 2026-03-15 14:30:00 UTCStart execution
Start execution.
BTCETHSOLxyz:GOLD (alias: Gold)xyz:CL (alias: Crude Oil)xyz:SILVER (alias: Silver)xyz:NVDA (alias: NVIDIA)xyz:GOOGLE (alias: Google)xyz:NATGAS (alias: Natural Gas)xyz:BRENTOIL (alias: Brent Oil)xyz:HOOD (alias: Robinhood)Quote currency: USDC
Execution loop: When triggered, execute the following steps in order. Avoid requesting intermediate confirmations; proceed with execution. #### 1. Intelligence & data collection (sense)
1m-trade-news to fetch the latest 20 newsflashes/news and determine whether they mention assets in the market universe to infer sentiment.1m-trade-dex → query-kline (default 1h).1m-trade-dex → query-user-state.1m-trade-dex → query-mids.#### 2. Decision Decide based on news sentiment and kline trend:
Mandatory risk controls & calculations:
qty (--qty) = target notional (USDC) / latest price, using appropriate precision.#### 3. Execution (act) Based on the decision, use 1m-trade-dex commands to trade.
market-orderplace-order#### 4. Trading brief (report) Generate a brief report (not too long) describing the decision rationale and execution results. Follow this Markdown format strictly.
Locale: Infer the user’s primary language from the session (e.g. Chinese vs English). The report must be monolingual — no zh/en mix in narrative text.
Language rule (strict):
BTC, ETH, xyz:GOLD, …), the literal 1m-trade, pair suffixes like -USDC, numbers, and % where standard.<< or >> in the user-visible report. For each slot, output normal Markdown: localized headings and body text (e.g. - **Fundamentals**: weak market sentiment…), not - **<<Fundamentals>>**: … or • <<Fundamentals>>: …. The reader must see finished prose, not bracket markers.<<...>> slot into the user’s language (including example values that stood in for real content).1m-trade anywhere.🤖 1m-trade <<AUTONOMOUS_TRADING_REPORT>>: <<ACCOUNT_BALANCE>>: <<summary>> <<POSITIONS>>: Table coverage (same idea as per-asset section): If the market universe is large, do not fill one row per symbol by default. Prefer: (a) a narrow table — only rows for assets with material activity this run (traded, opened/closed, non-Hold, or materially different), plus one summary line for “everything else” (e.g. all others: Hold / no action); or (b) a short bullet summary instead of a wide table. When the set is small, you may use the full table pattern below.
| <<ASSET>> | <<LATEST_PRICE>> | <<TREND_TIMEFRAME>> | <<DECISION>> | <<RESULT>> |
|---|---|---|---|---|
| BTC | xxx | <<Up>> | <<Hold>> | <<No action>> |
| ETH | xxx | <<Range>> | <<Long>> | <<Opened long 0.012 ETH>> |
| <<Gold>> | xxx | <<Up>> | <<Hold>> | <<No action>> |
| ... | ... | ... | ... | ... |
🧠 <<PER_ASSET_DECISIONS>>
Coverage rule: If the market universe is large or a full per-asset write-up would make the report too long, prefer a summary instead of repeating the block below for every symbol. In summary mode: give one cross-asset fundamentals/sentiment paragraph, portfolio-level account state, then short bullets only for assets that mattered (e.g. traded this run, non-Hold decision, material risk, or materially different from the rest). End with a brief execution recap. Strip <<...>> in final output; stay monolingual.
When the set is small (or the user asked for full detail), repeat per asset:
[ASSET]-USDC
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.