The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill implements an auto-update and modular loading mechanism that fetches manifest files and markdown modules from the vendor's official GitHub repository (bybit-exchange/skills) and API (api.bybit.com). These are verified vendor resources.
[DYNAMIC_EXECUTION]: The oauth module downloads and executes a JavaScript helper (oauth.js) using Node.js to handle account authorization. This execution is protected by a SHA256 checksum pinned directly in the oauth.md instructions to ensure file integrity.
[COMMAND_EXECUTION]: The skill utilizes standard system utilities including curl for network requests, shasum for integrity verification, and openssl for secure local transaction signing (HMAC-SHA256 and RSA-SHA256).
[INDIRECT_PROMPT_INJECTION]: The skill identifies a potential attack surface where instructions could be embedded in external API data (e.g., P2P chat messages or order notes). It includes explicit defensive rules to treat all API response fields as untrusted data, requiring them to be displayed as plain text without interpretation.
[SAFE]: The skill follows security best practices for AI agents, such as using environment variables for credential storage, enforcing mandatory human confirmation for high-risk actions (Mainnet trades), and implementing large-order protections.

bybit-trading