The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill implements an automated update and module-loading mechanism that fetches content from Bybit's official API (api.bybit.com) and GitHub repository (raw.githubusercontent.com/bybit-exchange/). These operations are verified using SHA256 checksums defined in a versioned manifest to prevent tampering during transit.
[REMOTE_CODE_EXECUTION]: The skill downloads a dedicated JavaScript helper (modules/oauth.js) for handling OAuth PKCE flows and executes it using the Node.js runtime. This process is protected by a mandatory bootstrap phase that verifies the script's hash against a pinned value before execution.
[COMMAND_EXECUTION]: The instructions direct the agent to use various system utilities including curl for networking, openssl for HMAC/RSA request signing, and shasum for file integrity validation. These are used within the context of the skill's primary functional requirements.
[INDIRECT_PROMPT_INJECTION]: The skill identifies a potential attack surface where instructions could be embedded in API response fields (e.g., orderLinkId, nickname, or P2P chat messages). It includes explicit instructions for the agent to treat all such data as untrusted, recommending they be wrapped in code blocks and never interpreted as executable commands.
[CREDENTIALS_SAFE]: The skill manages sensitive API keys and secrets using environment variables or a local encrypted store. It enforces strict output rules, requiring the agent to mask credentials (showing only prefixes or suffixes) and forbidding the display of private key material or raw secret values in any generated code or logs.

bybit-trading