Security checks across malware telemetry and agentic risk
This skill appears to deploy Hummingbot infrastructure for its stated purpose, but it uses risky installation, credential, and persistent configuration patterns that need human review before use.
Install only in an isolated test environment first. Replace all default credentials, avoid exposing services beyond localhost, review any remote scripts before execution, do not pass real exchange or trading credentials on command lines, and check where the MCP registration stores credentials before connecting live accounts.
#
set -eu
# Load .env if present
for f in hummingbot-api/.env ~/.hummingbot/.env .env; do
if [ -f "$f" ]; then
set -a; source "$f"; set +aset -eu
# Load .env if present
for f in hummingbot-api/.env ~/.hummingbot/.env .env; do
if [ -f "$f" ]; then
set -a; source "$f"; set +a
breakset -eu
# Load .env if present
for f in hummingbot-api/.env ~/.hummingbot/.env .env; do
if [ -f "$f" ]; then
set -a; source "$f"; set +a
break64/64 vendors flagged this skill as clean.