Security audit
Security checks for vulnerabilities and agentic risk
This skill is a narrowly scoped Bitfinex lending summary tool that uses user-provided API credentials to read funding data, with no evidence of hidden persistence, mutation, or exfiltration beyond Bitfinex API access.
Use a dedicated read-only Bitfinex API key limited to wallet, funding, and ledger/history reads. Do not provide trading, transfer, or withdrawal permissions, and only run the script when you intentionally want it to fetch Bitfinex funding account data.
The skill requires environment variables for API credentials and performs network access to Bitfinex, but it does not declare any explicit tool scope or permissions. This creates an authorization and review gap: the skill can access secrets and external services without clear upfront constraints, increasing the chance of unintended execution or over-privileged use.
The invocation description is broad enough that routine requests about Bitfinex lending yield or daily summaries could trigger the skill without the user explicitly intending API-backed account access. In this context, accidental invocation matters because the skill uses credentials and external network calls tied to a financial account.
This code makes authenticated network requests to Bitfinex using API credentials and retrieves wallet, credit, and ledger data. While the script purpose implies Bitfinex access, the file does not provide any user-facing notice that account and transaction data will be sent to and fetched from a third-party service beyond low-level implementation details.
The natural-language description and summary combine English with Chinese terms such as '收益' and '借贷利息' without stating that the user can choose their preferred language or locale. This can violate language/locale policy expectations when a skill implicitly forces or assumes a language style without opt-in.
No suspicious patterns detected.
