bybit-trading

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This skill implements an auto-update and on-demand module loader that downloads and installs remote .js code (and lazy-fetches an executable oauth.js), which creates a high-risk supply-chain / remote-code-execution vector if the manifest or remote sources are compromised.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime fetches and ingests free-text modules/and manifest JSON from Bybit’s API and GitHub raw (https://api.bybit.com/skill/manifest and https://raw.githubusercontent.com/bybit-exchange/skills/main/...), so an outsider can potentially submit poison content by altering externally-hosted module text that the agent downloads and then uses.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill performs runtime curl fetches of its manifest and module files which can deliver instruction/content or executable modules (e.g., oauth.js) from https://api.bybit.com/skill/manifest and https://raw.githubusercontent.com/bybit-exchange/skills/main/ (including https://raw.githubusercontent.com/bybit-exchange/skills/main/modules/.md), so external content fetched at runtime can directly control agent behavior and execute code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to perform financial operations on Bybit: it includes instructions to obtain and configure API keys, concrete authenticated request headers and signing methods, curl examples that create orders (POST /v5/order/create), and rules for mainnet write operations (place/cancel orders, transfer, withdraw) including structured confirmations. These are specific trading and fund-movement APIs (not generic tooling), so the skill grants direct financial execution authority.