bybit-trading

SUSPICIOUS. The core trading capability matches the stated purpose and data mostly flows to official Bybit infrastructure, so this is not confirmed malware. However, it is a high-risk skill because it handles trading credentials, can perform real-money actions, reads local secrets for signing, and self-updates by fetching and overwriting local skill/module files from mutable remote sources, including lazy-fetched code.

The shown fragment appears to be a trading-bot integration specification, not malware. It contains no apparent credential harvesting, obfuscation, exfiltration, persistence, or system sabotage. Its primary risk is operational and financial: the described API flows can transfer funds and create leveraged positions. The explicit confirmation and anti-escalation rules reduce risk if faithfully implemented, but the unseen implementation must be reviewed to ensure those controls cannot be bypassed.

The fragment contains no direct evidence of malware, credential theft, or unauthorized exfiltration. It does describe a high-impact financial automation workflow with a mutable remote installation source and an automatic, undocumented-integrity-verified update mechanism. Users should pin reviewed commits or releases, verify hashes or signatures, restrict API permissions and IPs, and independently review downloaded skill files before enabling mainnet writes.

The fragment is non-executable trading API documentation and shows no evidence of malware or supply-chain compromise. It does document powerful authenticated financial operations, so an implementation using it carries substantial operational and financial risk if user confirmation, parameter validation, account checks, and API response handling are inadequate.