Trust Report v1

1m-trade-dex

| Hyperliquid DEX/Perps entrypoint via `hl1m`: market queries, order placement. Wallet creation/management at https://www.1m-trade.com; local `hl1m init-wallet` with address + proxy (API) private key — never the main wallet key. No in-skill private-key messaging.

Overall

Trust

Utility

Momentum

Install caution

High-risk behavior present

Risk: High

Source: OpenClaw Master Skills

Path: skills/1m-trade/skills/1m-trade-dex/SKILL.md

Review flags: browser/session access, network access or external URLs, package installation commands, shell command snippets. These are review signals, not definitive security judgments; inspect before installing.

Required permissions

• Environment variables / secrets
• Shell commands
• Network/API usage
• Browser/session access

Permissions are inferred from SKILL.md text only. They are review prompts, not guarantees about runtime behavior.

Risk flags explained

browser_or_session_accessmedium

Mentions browser automation, cookies, sessions, local storage, or browser state.

network_accessmedium

Mentions external URLs, network APIs, downloads, or HTTP client usage.

package_installmedium

Mentions package installation or dependency-fetching commands.

shell_commandmedium

Contains shell command snippets. Review commands before copy/paste or agent execution.

Score explanation

Trust

• Trust starts at 90 before review-signal penalties and metadata bonuses.
• Risk-signal penalty: -40 from 4 detected flag(s).
• Metadata bonus: +2 from author/version/description fields.

Utility

• Utility starts at 55 and rewards clear descriptions, runnable examples, and explicit setup needs.
• Description present: yes.
• Command examples detected: 2.
• Environment variables detected: 1.

Momentum

• Momentum starts at 45 and uses public repo activity signals.
• Recent commit activity: latest repo update was 6 day(s) ago.
• Recent commit volume: 6 commit(s) in the lookback window (+18).
• Source has strong public adoption: 2049 stars.
• Fork activity suggests reuse: 309 forks.

Overall

• Overall score weights trust 45%, utility 35%, and momentum 20%.

Detected signals

Env vars

• API

Commands

• python -m pip install --user pipx
• python -m pipx ensurepath

URLs

• https://www.1m-trade.com
• https://www.1m-trade.com;

Provenance & evidence

SkillRadar makes each review traceable back to the exact source path, source blob SHA, scanner version, and text-only policy that produced the report.

source

github.com/LeoYeAI/openclaw-master-skills@main

path

skills/1m-trade/skills/1m-trade-dex/SKILL.md

source blob SHA

132511fb7b4bbe7ed670316013e173bbe34e7537

scanner version

0.3.0

security model

text_only_no_execute_no_install_no_secrets

scan policy

Fetched and scored as text only; no install, no execution, no runtime loading.

Evidence snippets

package_install

…` - If `pipx` is missing: - Linux: install `pipx` via `apt` / `yum` / `dnf` - macOS: `brew install pipx` - Windows: `python -m pip install --user pipx` then `python -m pipx ensurepath`…

network_access

…rps entrypoint via `hl1m`: market queries, order placement. Wallet creation/management at https://www.1m-trade.com; local `hl1m init-wallet` with address + proxy (API) private key \u2014 n…

browser_or_session_access

…offered by the product), direct users to **[1M-Trade](https://www.1m-trade.com)** in the browser. Do not recreate that flow inside chat. - After the user has what they need from the site…

shell_command

…tion]", "name": "1m-trade-dex", "requires": "bins: [hl1m]"} ## Setup ### 1. Install CLI ```bash which hl1m ``` If `hl1m` is missing, install the `1m-trade` package (requires Python 3.1…

Watch this skill

Get alerted when this skill adds credential requirements, shell commands, external domains, remote installer patterns, or risk-level changes.

Join watchlist beta

Methodology note

SkillRadar scans SKILL.md as hostile text only. It does not execute commands, install packages, or load third-party skills.

View source SKILL.md Back to changes View sources