The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions in SKILL.md mandate a self-update mechanism and a 'Module Router' that fetch instructional markdown files from https://raw.githubusercontent.com/bybit-exchange/skills/main/ and direct the agent to 're-read' or load them into the current session. This allows a remote source to dynamically modify the agent's instructions and behavior.
[COMMAND_EXECUTION]: The skill uses multiple shell commands to manage its lifecycle and perform trading operations. This includes executing curl for downloads, shasum for integrity verification, mkdir and mv for file management during updates, and openssl for cryptographic signing of API requests. The update logic specifically uses piped commands like shasum -a 256 <temp_file> | awk '{print $1}'.
[CREDENTIALS_UNSAFE]: The skill instructs the agent to access and read a local RSA private key file from a user-defined path (BYBIT_API_PRIVATE_KEY_PATH). It uses openssl rsa -in "$BYBIT_API_PRIVATE_KEY_PATH" -text -noout to verify the key, which requires the agent to have read access to sensitive local files, increasing the risk of credential exposure.
[PROMPT_INJECTION]: The skill contains 'concealment' patterns, instructing the agent to run the update process as a 'background sub-agent' and to 'silently continue' if an update fails or is not found. This hides automated instruction changes and network activities from the user's view.
[EXTERNAL_DOWNLOADS]: The skill performs automated network requests to api.bybit.com and raw.githubusercontent.com at the start of every session to check for manifests and download module files.

bybit-trading