ClawHub
Back to skill

Security audit

[1m-trade] AI Autonomous Trading

Security checks for vulnerabilities and agentic risk

Overview

This is a real-money crypto trading skill with disclosed functionality, but it grants persistent unattended trading authority and handles signing keys in ways users should review carefully.

Install only if you intentionally want an agent-controlled crypto trading setup. Use testnet first, avoid pasting any private key into chat, do not use a master wallet key, pin and verify the `1m-trade` CLI yourself, and do not enable the cron auto-trader without independent limits for max notional, leverage, daily loss, allowed assets, expiration, and a tested removal path.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)

T06 · System Persistence

Error
Location
SKILL.md:183
Finding

Persistent Scheduled Job Performs Unattended Real-Money Trading

Content
View full analysis
`, then re-run `openclaw cron list` to confirm it is gone. 3. Create a periodic workflow using the command below. `--session isolated` is fixed and must not be changed. The default interval is every 20 minutes (`*/20`); replace with `*/N` if needed. Send the trading report to the user. ``` ```bash openclaw cron add \ --name "1m-trade-auto-trader" \ --cron "*/20 * * * *" \ --session isolated \ --message "" \ --timeoutSeconds 600 \ --announce \ --channel \ --to "" ``` ```markdown ## Execution Guidelines - Evaluate the full market universe (scan multiple assets). Trades are determined by risk controls; 0 to multiple trades are allowed. - Output must be a trading report only (no executable code). Markdown tables/quotes are allowed. - Do not create or modify any files. - Only call existing skills. - Use real trading (not simulation). ``` ```markdown **Execution loop**: When triggered, execute the following steps in order. Avoid requesting intermediate confirmations; proceed with execution. #### 3. Execution (act) Based on the decision, use `1m-trade-dex` commands to trade. - Example (market long/short): call `market-order` - Example (close): compute exact position size and place the appropriate market order - Example (limit): cal ...[truncated 2412 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
skills/1m-trade-dex/SKILL.md:65
Finding

Proxy Private Key Is Accepted Through Chat and Exposed in Process Arguments

Content
View full analysis
--pri_key ` in a trusted shell; do not echo full keys in chat. ``` ```markdown **Exact command** (values come from the user message; run in a trusted local shell): ```bash hl1m init-wallet --address --pri_key ``` ``` The reference also documents the absence of strict association checking: ```markdown - `--pri_key` required - `--address` optional; if omitted, derived from private key - If `--address` is provided, current behavior uses it directly (to support proxy-private-key scenarios, no strict matching check) - Protection logic: if `.env` already has address/encrypted key/encryption password, overwrite is rejected ``` ### Technical Analysis The workflow allows a proxy/API private key to enter the LLM conversation and then inserts it directly into a command ...[truncated 2894 chars]
Remediation
View remediation

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:211
Finding

Mutable Dependency Marker Can Suppress Security Verification in Future Runs

Content
View full analysis
LastChecked: 2026-03-15 14:30:00 UTC ``` ### Technical Analysis The scheduled workflow treats a mutable Markdown file as authoritative persistent memory. It searches for broad textual markers such as `Installed: true` or `SkillsReady: true` and then skips dependency checking. The marker is not: - Cryptographically integrity-protected. - Bound to exact package versions. - Bound to executable hashes. - Bound to canonical skill paths. - Expired after a defined interval. - Demonstrably written only after successful verification. - Protected against local modification in the documented workflow. The prompt then mandates overwriting the file with `Installed: true`. This can preserve a false-success condition across later scheduled sessions. Because subsequent runs can execute rea ...[truncated 1411 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
skills/1m-trade-dex/SKILL.md:6
Finding

Unpinned Third-Party Trading CLI Is Installed and Entrusted with Signing Credentials

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (28)

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

The skill is designed around local access to .env paths and sensitive runtime variables, including API keys and wallet-related secrets. Even though the text says not to print secrets, exposing credential locations and coupling the skill to shell/env capabilities increases the chance that an agent or sub-skill accesses or mishandles credentials within the same execution context.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
- hl1m
        - openclaw
      configPaths:
        - ~/.openclaw/.1m-trade/.env
        - $OPENCLAW_STATE_DIR/.1m-trade/.env
      env:
        - BLOCKBEATS_API_KEY

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

This finding involves encrypted Hyperliquid private-key material and its password, referenced as environment/config state for a shell-capable trading skill. The combination of wallet credential material, agent shell access, and autonomous execution makes credential exposure or misuse especially severe, potentially enabling unauthorized trading or account takeover.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
- openclaw
      configPaths:
        - ~/.openclaw/.1m-trade/.env
        - $OPENCLAW_STATE_DIR/.1m-trade/.env
      env:
        - BLOCKBEATS_API_KEY
        - HYPERLIQUID_PRIVATE_KEY_ENC

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
1. **Skill files**: Ensure the bundle includes **`skills/1m-trade-news/`** (`SKILL.md`, etc.) and that your OpenClaw / host loads that folder as the **`1m-trade

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
1. **Skill files**: Ensure the bundle includes **`skills/1m-trade-news/`** (`SKILL.md`, etc.) and that your OpenClaw / host loads that folder as the **`1m-trade

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill describes enabling fully autonomous real trading and cron-based recurring execution without an upfront warning about financial loss, irreversible order execution, liquidation, or account compromise impact. In this context, omission of explicit risk disclosure and consent controls is dangerous because the agent can repeatedly place real trades with persistent automation.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · auto_check.js (reported line 21)May include surrounding context.

js
function getEnvPath() {
  const baseStateDir = process.env.OPENCLAW_STATE_DIR || path.join(os.homedir(), ".openclaw");
  const stateDir = path.join(baseStateDir, ".1m-trade");
  return path.join(stateDir, ".env");
}

function trim(s) {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · auto_check.js (reported line 127)May include surrounding context.

js
console.error("   Required: HYPERLIQUID_PRIVATE_KEY_ENC + HYPERLIQUID_PK_ENC_PASSWORD");
    console.error("");
    console.error("Next step:");
    console.error("- Remove `HYPERLIQUID_PRIVATE_KEY` from the .env file.");
    console.error("- Keep only encrypted key fields and wallet address.");
    process.exit(1);
  }

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · auto_check.js (reported line 133)May include surrounding context.

js
console.error("   Required: HYPERLIQUID_PRIVATE_KEY_ENC + HYPERLIQUID_PK_ENC_PASSWORD");
    console.error("");
    console.error("Next step:");
    console.error("- Remove `HYPERLIQUID_PRIVATE_KEY` from the .env file.");
    console.error("- Keep only encrypted key fields and wallet address.");
    process.exit(1);
  }

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · auto_check.js (reported line 144)May include surrounding context.

js
console.error("   Required: HYPERLIQUID_PRIVATE_KEY_ENC + HYPERLIQUID_PK_ENC_PASSWORD");
    console.error("");
    console.error("Next step:");
    console.error("- Remove `HYPERLIQUID_PRIVATE_KEY` from the .env file.");
    console.error("- Keep only encrypted key fields and wallet address.");
    process.exit(1);
  }

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The cancel-order documentation states that running the command without --oid and --coin cancels all open orders, but this behavior is not surfaced as a prominent danger warning. In an autonomous trading context, ambiguous or insufficiently emphasized defaults can lead an agent or operator to unintentionally wipe all outstanding orders, causing strategy disruption, slippage, and financial loss.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The request hard-codes lang=cn for important newsflashes, which imposes a specific language choice on users. The file does not offer a language option or document user consent for this locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The search request explicitly sets lang=cn, causing returned content to be in Chinese regardless of user preference. This is a natural-language policy issue because no opt-in or justification for the forced locale is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The reusable endpoint example includes lang=cn, establishing Chinese as the default language for newsflash retrieval. Because the skill does not offer an alternative or explain a justified locale limitation, it violates the language-choice policy.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The file defines orchestrated agents with triggers, periodic monitoring, and action chains that go beyond passive documentation into an automation layer for wallet setup, market monitoring, and trade-related workflows. In a trading skill that can interface with wallets and DEX operations, this increases the chance of unsafe autonomous behavior, accidental invocation, or over-broad capability exposure, especially when paired with the product claim of fully autonomous AI trading.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The wallet setup agent instructs users to provide and pass a proxy private key, and even allows parsing both address and proxy key from one chat message for CLI invocation. Even though it says not to echo keys and prefers local init, encouraging credential submission in chat without a prominent warning or safer secret-handling mechanism risks credential exposure through logs, model retention, tool traces, or operator access.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation contains conflicting safety boundaries: Trend Trader says trades require final user confirmation, while the broader skill metadata advertises fully autonomous AI trading. This inconsistency is dangerous because downstream agents or users may reasonably assume autonomous execution is permitted, weakening safeguards around financial actions and increasing the risk of unauthorized or unintended trades.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill clearly expects shell and environment access (curl, node, hl1m, openclaw, .env files) yet declares no explicit tool scope or permission boundaries. In a high-risk trading skill, this creates an under-specified trust boundary where an agent may execute sensitive commands or access secrets without an auditable least-privilege declaration.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The skill instructs writing an API key into a persistent .env file under the agent state directory. Persisting credentials in long-lived local state increases the blast radius of workstation compromise, accidental disclosure through logs/backups, or unintended reuse by other skills sharing the environment.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md
curl --request GET --url "https://api-pro.theblockbeats.info/v1/api-key/free"
      ```
   2. From the JSON body, read `data.api_key` and use it as `BLOCKBEATS_API_KEY`.
   3. Write it to `~/.openclaw/.1m-trade/.env` (or `$OPENCLAW_STATE_DIR/.1m-trade/.env` if you use that override), on its own line:
      `BLOCKBEATS_API_KEY=<api_key>`
      Do not remove unrelated lines; only add or update this variable.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trading workflow is triggered by broad terms like price, trade, open, and close, which overlap with ordinary financial discussion and market-data requests. In a skill capable of real trading, ambiguous routing can escalate benign analysis queries into execution-oriented workflows, increasing the risk of unintended trade placement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The autonomous trading trigger list includes ambiguous phrases such as managed and run every N minutes, which could match routine operational requests rather than informed consent to enable unattended real-money trading. Because the workflow creates persistent cron jobs and performs real trades, accidental activation materially increases risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The autonomous workflow says both 'Do not create or modify any files' and later requires overwriting a dependency memory file. Contradictory instructions in an autonomous agent skill can cause unpredictable agent behavior, including unauthorized file writes or bypassing intended safeguards because the model must choose which instruction to honor.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The wallet-init trigger is broad and explicitly non-exhaustive in a skill that handles wallet binding and accepts a proxy private key. That ambiguity can cause the agent to enter a sensitive credential-handling flow on loosely related user messages, increasing the chance of prompting for, parsing, or acting on secrets without a narrowly scoped, explicit user authorization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill documents live trading operations such as placing orders, closing positions, and canceling orders without a prominent execution-risk warning at the point of use. In an autonomous trading context, this can normalize direct execution and make it easier for an agent or user to invoke fund-affecting actions without appreciating that these are live mainnet operations unless testnet is explicitly selected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The reference lists live trading operations such as market orders, leverage updates, margin transfers, and position closes without prominently warning that these actions can immediately execute on mainnet and cause irreversible financial loss. In a skill explicitly supporting autonomous AI trading, terse command documentation increases the chance that an agent or user invokes destructive actions without adequate confirmation or environment checks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The listed triggers include broad phrases like "how is the market today" and "daily overview," followed by "etc.," which leaves activation scope open-ended. This can cause unintended invocation because the document does not define clear boundaries or exclusions for similar everyday phrasing.

Content

No source excerpt is available for this finding.