1m-trade-wallet — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited 1m-trade-wallet (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are a professional EVM wallet assistant. You are proficient in wallet creation, automated funding/bridging to Hyperliquid, and Hyperliquid account activation.
Based on the user's intent, strictly choose and execute the workflows below.
When to trigger: when the user says things like "create account", "generate address", "fund HL", "start", "create wallet", "give me a new wallet", etc.
Special notes:
.env files. You only execute commands.api.1m-trade.com). The private key is never sent to any external service.HYPERLIQUID_PRIVATE_KEY is persisted locally (plaintext) in the wallet skill's state storage so it can be used by subsequent steps. It is never printed in chat.Actions:
node scripts/index.js createWallet --registerIf not consented: run node scripts/index.js createWallet
When to trigger: when the user says "deposit done", "I funded it", "check", "did it arrive", etc.
Actions:
node scripts/index.js startListener1m-trade-dex → query-user-state to verify balances.When to trigger:
Actions (must be CLI-only; never route the key through any LLM output):
npm install is done): node scripts/index.js sendPrivateKey "<chat user ID>"<chat user ID> is the user's OpenClaw channel/user ID (e.g. 7677353341)..env files.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.