bybit-order-book

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:08 AM UTC
• Version: 1.0.0

Overview

The skill appears to implement the advertised Bybit data and backtesting workflow, but it uses risky browser automation and unsafe dependency installation that users should review before installing.

Install only in an isolated virtual environment or disposable container, do not run as root, and review whether automating Bybit's Cloudflare-protected page is acceptable for your use case. Prefer manual download or an official API/source if available, and restrict the skill to dedicated data and report directories.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned dependencies installed into the system-managed Python environment

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–22
Vulnerability Type: Supply-chain exposure and unsafe system package modification
Risk Level: Medium

Vulnerable Code

bash

pip install undetected-chromedriver selenium pandas numpy pyarrow --break-system-packages

Technical Analysis

The installation instructions specify mutable package names without exact versions or cryptographic hashes. Consequently, the packages installed at a later date may differ from those reviewed during this audit. Package installation can execute package-controlled build or installation logic with the permissions of the invoking user.

The --break-system-packages option also bypasses the protection that normally prevents pip from modifying a distribution-managed Python environment. This can overwrite or conflict with operating-system-managed libraries and increase the blast radius beyond an isolated project environment.

No evidence was found that the named packages are currently malicious. The vulnerability is the unsafe and non-reproducible dependency installation process.

Attack Path

1. A user follows the dependency installation command in SKILL.md.
2. pip resolves mutable package releases from the configured package index.
3. A compromised upstream release, package-index account, mirror, or dependency in the transitive dependency graph supplies malicious installation or runtime code.
4. The malicious package code executes with the permissions of the user running pip.
5. Because --break-system-packages is enabled, installation can also alter the system-managed Python environment and affect unrelated Python applications.

Impact Assessment

Successful exploitation could execute arbitrary code with the invoking user's privileges. This may permit access to that user's files, environment variables, browser data, and network resources. If the installation command is run with elevated privi ...[truncated 234 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --break-system-packages from the documented installation command.
2. Require installation in an isolated virtual environment:

   bash

   python3 -m venv .venv
   . .venv/bin/activate
   python -m pip install --upgrade pip
   python -m pip install --require-hashes -r requirements.txt
   

3. Pin every direct and transitive dependency to a reviewed exact version.
4. Add hashes for all permitted distributions and install with --require-hashes.
5. Generate and commit a reproducible lock file using a dependency-locking tool.
6. Regularly scan locked dependencies for known vulnerabilities and review dependency updates before adoption.
7. Advise users not to run dependency installation as root or through sudo.

T09 · Insecure Skill Coding Practices

Error

• Location: download_orderbook.py:71

Finding

Chrome sandbox disabled while processing remote web content

Content

View full analysis

Vulnerability Details

File Location: download_orderbook.py, lines 71–79
Vulnerability Type: Browser security boundary disabled
Risk Level: High

Vulnerable Code

python

def create_driver(download_dir: str, headless: bool = True):
    """Create an undetected Chrome driver with download directory configured."""
    options = uc.ChromeOptions()
    if headless:
        options.add_argument("--headless=new")
    options.add_argument("--no-sandbox")
    options.add_argument("--disable-dev-shm-usage")
    options.add_argument("--disable-gpu")
    options.add_argument("--window-size=1920,1080")

Technical Analysis

The downloader unconditionally starts Chrome with --no-sandbox. The browser then navigates to the remotely controlled, JavaScript-rendered Bybit website. Chrome's sandbox normally limits the operating-system access available to compromised renderer processes. Disabling it removes a significant defense-in-depth boundary.

This flag does not by itself create a browser exploit. Exploitation requires a browser or driver vulnerability, malicious remote content, or compromise of content delivered by the target site. However, if such an initial compromise occurs, the absence of the sandbox can substantially increase access to the host.

The risk is heightened by the use of undetected-chromedriver, which controls a full browser and may track browser releases differently from standard Selenium deployments.

Attack Path

1. The user runs download_orderbook.py.
2. create_driver() launches Chrome with --no-sandbox.
3. The driver opens https://www.bybit.com/derivatives/en/history-data and executes remotely supplied JavaScript and other browser content.
4. A compromised site, third-party resource, malicious download flow, or browser vulnerability compromises a browser process.
5. Because Chrome's sandbox is disabled, the compromised process is not constrained by the normal re ...[truncated 889 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unconditional options.add_argument("--no-sandbox") setting.
2. Run Chrome with its sandbox enabled under a dedicated, non-privileged operating-system account.
3. If a specific container environment cannot support the Chrome sandbox, require an explicit opt-in CLI option and display a prominent security warning.
4. For unavoidable sandbox-disabled execution, use a hardened, disposable container with:
   • A non-root user.
   • No host filesystem mounts except a narrowly scoped download directory.
   • No secrets or credentials in the environment.
   • Dropped Linux capabilities.
   • A read-only root filesystem where practical.
   • Restricted outbound network access.
   • Seccomp and mandatory-access-control policies.
5. Keep Chrome, Selenium, and the driver fully patched and version-compatible.
6. Validate downloaded file types and sizes before subsequent processing.
7. Document that users must not run the browser automation as root.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code accurately implements part of the declared description: it contains 10 order-book-based strategies, backtests them on processed data, and generates performance reports including PnL, Sharpe ratio, win rate, and max drawdown. However, the declared purpose describes a broader skill that also downloads ByBit historical data using Selenium and processes/unzips ob500 JSONL files to depth 50. None of those ingestion/preprocessing capabilities appear in this code chunk. The chunk’s actual scope is narrower and assumes preprocessed Parquet input. Therefore the supplied description does not accurately represent what this code chunk itself does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a broad multi-stage system covering download, data processing, strategy execution, and reporting. The actual code chunk only covers the first part: automated downloading from ByBit’s history-data page using Selenium/undetected-chromedriver. There is no code for extracting ZIPs, parsing JSONL, filtering ob500 depth, implementing any of the listed 10 strategies, computing PnL or risk metrics, or producing reports. The downloader behavior itself is consistent with one subsection of the description, but the overall declared purpose materially overstates what this supplied code chunk does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This code matches only one narrow portion of the declared description: processing/unzipping ByBit ob500 order book files and filtering to a requested depth, with optional downsampling and feature extraction. The description, however, claims a much broader skill that includes automated downloading from ByBit using Selenium, execution of multiple trading strategies, and generation of full backtest reports. None of those capabilities appear in this code chunk. There are no suspicious undeclared external accesses beyond local file I/O, but the primary purpose of this specific code chunk is materially narrower than the declared skill, so this should be flagged as a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence

Finding

The skill describes operations that read from and write to local files and directories, but it does not declare any explicit tool scope or permissions boundaries. That creates ambiguity about what filesystem access is expected, increasing the risk of over-broad execution in agents that rely on metadata for sandboxing or user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs use of undetected-chromedriver to bypass Cloudflare protections for automated downloads, but it provides no warning about legal, account, privacy, or platform-abuse risks. In an agent context, this can normalize anti-detection behavior and cause users or automated systems to interact with third-party services in ways that violate terms, expose session data, or trigger account restrictions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code creates the output directory and writes JSON and Markdown report files, which affects the user's filesystem. Although the CLI exposes an --output argument, there is no confirmation prompt or explicit user-facing warning near the write operations about creating files or overwriting existing reports.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.