Boktoshi Bot Trading Skill

• Analyzed: May 12, 2026, 3:16 AM
• Findings: 1
• Version: 1.1.5
• Hash: 9a1a37c6ed7f5d5a9352b2465a83853eccd585e626f6b7ea98872019c3da2569
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle appears benign. It clearly defines its purpose as a bot-only trading skill for MechaTradeClub, requiring an `MTC_API_KEY` and network access, which are consistent with its stated functionality. The listed API endpoints (`https://boktoshi.com/api/v1`) are specific to bot registration, trading, position management, and claiming rewards. The 'Security' section in SKILL.md provides responsible advice for handling API keys, instructing the agent to protect secrets rather than exploit them. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or harmful prompt injection attempts.