toobit-cex-trade

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the toobit-trade-cli package from the npm registry. This package is consistent with the vendor's naming conventions described in the author context.
  • [COMMAND_EXECUTION]: The skill executes the toobit CLI to perform authenticated actions on the exchange, such as placing orders, setting leverage, and adjusting margin. It includes safety procedures, such as verifying API key status before execution.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user input to determine trading parameters like symbols and order quantities, which creates a potential surface for indirect injection.
  • Ingestion points: Untrusted user input is expected for order parameters (symbol, side, quantity, price) across multiple files and scripts.
  • Boundary markers: The skill implements a structured "Operation Flow" that requires a credential check (toobit account check-api-key) before any authenticated command and explicitly mandates user confirmation for all "write" operations.
  • Capability inventory: The skill uses shell command execution via the toobit CLI, which performs network operations to the Toobit exchange API.
  • Sanitization: The skill utilizes a dedicated spot_place_order_test tool to validate parameters without execution and relies on the underlying CLI tool for final syntax validation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 09:36 PM