Security audit

bybit-trading-skill

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed unofficial Bybit trading skill with real-money financial risk, but the sensitive access is purpose-aligned and guarded by testnet defaults, scoped credential guidance, and mainnet confirmation rules.

Install only if you intend to let an AI assistant help manage a Bybit account. Start on testnet, use a dedicated limited-balance sub-account, grant Read + Trade only, never enable withdrawals, and require a clear confirmation card before any mainnet trade, transfer, loan, Earn action, bot action, P2P message/upload, agreement, or account change.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (19)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The module advertises 'Pause' and 'Resume' as supported user intents, but later states the API has no user-accessible pause/resume and that stop is permanent and irreversible. In a real-money trading skill, this inconsistency can cause the agent to mis-handle a user's request, potentially stopping a live strategy permanently when the user only intended a temporary pause.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The README promises that users can 'tell any AI assistant one sentence, and it can execute trades,' which is overly broad for a real-money trading skill. In this context, ambiguous activation language increases the chance that normal market discussion, experimentation, or prompt-injected text could be misinterpreted as a trading instruction and trigger sensitive actions.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The instruction 'Just tell the AI what you want in natural language. The skill handles the rest' lacks precise boundaries for when the skill should execute trading actions versus merely explain or simulate them. Because this skill can place real orders, broad natural-language activation materially raises the risk of unintended execution from casual phrasing, misunderstood intent, or adversarial prompt content.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger examples are broad enough to match ordinary user requests like checking balances or moving funds, which increases the chance the skill is invoked in contexts the user did not clearly intend. In a financial trading skill with authenticated access, ambiguous activation can lead to unintended exposure of account data or progression toward sensitive actions without sufficiently explicit user intent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This module describes money-moving and debt-creating actions such as internal transfers, fixed-rate borrowing, and repayment without embedding strong user-warning or confirmation requirements alongside those operations. In the context of a real-money exchange skill, presenting these write actions as routine examples materially raises the risk of unauthorized or accidental financial transactions if the agent maps a casual request into an API call.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This module documents numerous authenticated POST endpoints for loans, RFQs, spread orders, broker settings, and other account-impacting actions, but does not pair them with prominent safety guidance about real-money effects, irreversibility, or the need for explicit user confirmation. In an AI trading skill context, that omission increases the risk that an agent could treat these operations as routine and initiate financially harmful actions without the user fully understanding the consequences.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The private WebSocket section includes an authentication example using apiKey, expires, and signature, and describes access to sensitive topics such as positions, orders, and wallet balances without warning against exposing secrets or streaming private account data into logs, prompts, or third-party contexts. In an agent-integrated environment, that can lead to credential leakage or unnecessary disclosure of sensitive financial data.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The module includes concrete authenticated follow-binding write operations that allocate real funds, but it does not require an explicit user confirmation step immediately before executing them. In a trading skill, this is dangerous because a conversational misunderstanding, prompt injection through user phrasing, or agent overreach could cause unauthorized real-money account actions such as following a leader and committing balance.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The instructions for placing copy-trading leader orders and closing positions describe direct live trading actions without an explicit warning or confirmation requirement. Because these endpoints can open or close real derivatives positions, omission of a confirmation barrier increases the risk of unintended execution, financial loss, and rapid position changes from misinterpretation or unsafe automation.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger examples for the Earn Products section are broad enough that ordinary portfolio or product-discovery requests like 'Deposit USDT' or 'Redeem' could activate a module capable of preparing real-money staking or redemption flows. In a trading skill with authenticated write actions, ambiguous invocation increases the chance the agent enters a transactional path without the user clearly intending to access Earn features.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The Fixed Term trigger list includes generic finance phrases like 'fixed deposit' and 'auto reinvest' that may match user requests not specifically about Bybit fixed-term earn products. Because this module documents stake, redeem, and auto-invest operations for locked products, ambiguous activation could steer the assistant into offering or initiating higher-risk investment actions under the wrong context.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The Advance Earn trigger examples include ambiguous investment language like 'leveraged position' and 'discount buy', which can map to complex structured products with substantial loss risk. In this context, accidental activation is more dangerous because the module supports high-risk products such as Smart Leverage, DoubleWin, and Dual Assets, and users may not realize they are entering a derivatives-like investment workflow.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The Liquidity Mining trigger list contains common action phrases like 'add liquidity', 'remove liquidity', and 'claim interest' without clear scoping to Bybit Earn liquidity mining. These phrases may overlap with other DeFi, exchange, or account-management intents, creating a risk that the assistant invokes leveraged liquidity operations when the user meant something else.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The remove-liquidity operation documents that omitting `removeRate` results in 100% withdrawal, but it does not require an explicit user warning or confirmation for full-position removal or single-asset withdrawal modes. In a real-money liquidity product, this omission can lead to unintended liquidation of the entire position or asset-conversion effects if the assistant constructs a request from incomplete user input.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The module documents a chat file upload endpoint and supported file types but provides no warning against uploading sensitive documents, personal data, or secrets. In a trading skill context, users may be induced to share bank statements, IDs, receipts, or account details in P2P disputes, creating a realistic privacy and data-exfiltration risk if the agent encourages or automates uploads.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This module provides direct, concrete examples for placing real spot buy and sell orders on an authenticated Bybit account, but does not include an explicit warning at the point of use that these actions can execute irreversible real-money trades. In the context of a trading skill, omission of a strong transactional warning increases the chance that an agent or user treats examples as routine commands and unintentionally places live orders, especially because the file includes write endpoints alongside recommendation language like 'recommended' and ready-to-send payloads.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The broad natural-language examples at the top of the module can make on-demand loading or intent matching trigger on vague phrases like 'stop my strategy' or 'chase the best price' without sufficient disambiguation. Because this skill can place or terminate real-money trading strategies, ambiguous invocation raises the risk of unintended high-impact actions being selected from casual or underspecified user input.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This section documents bot-creation and bot-closing actions that can commit or liquidate real assets, but it does not require prominent user-facing warnings about financial risk, settlement effects, or the consequences of close modes. In a trading skill connected to authenticated exchange APIs, omission of such warnings increases the chance that an agent or user triggers irreversible money-moving actions without understanding asset conversion or loss implications.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The futures sections describe leveraged grid, martingale, and combo bots, including auto-cycle restart and auto-rebalancing behavior, without strong warnings about leverage amplification, liquidation risk, cascading losses, or unattended repeated trading. Because these endpoints control complex automated derivatives strategies on an authenticated account, the missing guardrails materially increase the chance of severe financial harm from misunderstood or overly broad natural-language requests.

Static analysis

No suspicious patterns detected.