Bitfinex Lending Monitor

Monitor Bitfinex lending (funding) performance via API. Use when the user asks to check Bitfinex funding收益/借贷利息, automate daily收益统计, or avoid opening the Bit...

Security Scan

The skill's code and instructions match the stated purpose (read-only Bitfinex lending monitoring) but the registry metadata omits required secrets and there are small path/declaration mismatches — this inconsistency should be resolved before trusting or automating the skill.

Purpose & Capability

The name/description and the included script both perform read-only Bitfinex lending/funding queries — that is coherent. However the registry metadata declares no required environment variables or primary credential while both SKILL.md and the script require BITFINEX_API_KEY and BITFINEX_API_SECRET. The absence of declared secrets in metadata is a meaningful mismatch.

Instruction Scope

SKILL.md explicitly instructs exporting BITFINEX_API_KEY and BITFINEX_API_SECRET and running the provided script. The instructions and script access only Bitfinex v2 authenticated endpoints (wallets, funding credits, ledgers) and do not read other system files or send data to unrelated endpoints. Minor issue: the SKILL.md run path (skills/bitfinex-lending-monitor/scripts/...) does not match the manifest path (scripts/check_lending.py), which could confuse usage.

Install Mechanism

This is an instruction-only skill with an included Python script and no install spec. There are no downloads or external install steps, so nothing is written/installed by an automated installer.

Credentials

The script legitimately requires two sensitive environment variables (BITFINEX_API_KEY and BITFINEX_API_SECRET) to call authenticated endpoints — that is proportionate. However the registry metadata failing to declare these required secrets (and failing to identify a primary credential) is a significant omission that affects user consent and risk assessment.

Persistence & Privilege

The skill is not always-enabled and does not request persistent system-wide privileges. It does not attempt to modify other skills or system config. Autonomous invocation is allowed by default, but there are no additional privileges requested here.

What to consider before installing

This skill appears to be a straightforward Bitfinex lending/funding reader, but the registry metadata is inconsistent with the runtime requirements. Before installing or giving it to an agent: - Do not provide full-access API keys. Create a dedicated Bitfinex API key limited to read-only wallet/funding/ledger permissions. - Confirm the skill registry metadata is updated to declare BITFINEX_API_KEY and BITFINEX_API_SECRET (and set primaryEnv appropriately) so automated permission prompts are accurate. - Review the included scripts yourself (they are small) to confirm there are no unexpected network endpoints; the script calls only api.bitfinex.com and signs requests with HMAC-SHA384. - Note the slight path mismatch in the README/run instructions; run the script from the correct location or update SKILL.md. - If you plan to allow autonomous invocation, consider the blast radius: a compromised read-only key can reveal balances and transaction history. Keep keys isolated and rotate them if used for automation.

Use this skill to fetch and summarize Bitfinex funding收益 from API.

What to collect

• Funding wallet balances from v2/auth/r/wallets
• Active funding credits from v2/auth/r/funding/credits/{Symbol}
• Ledger entries from v2/auth/r/ledgers/{Currency}/hist filtered by wallet=funding

Run

1. Export API credentials:

export BITFINEX_API_KEY="your_api_key"
export BITFINEX_API_SECRET="your_api_secret"

2. Run summary:

python3 skills/bitfinex-lending-monitor/scripts/check_lending.py --currency USD --days 7

3. Optional JSON output:

python3 skills/bitfinex-lending-monitor/scripts/check_lending.py --currency USD --days 7 --json

Notes

• Prefer read-only API permissions for safety.
• Timestamps are milliseconds since epoch.
• If no --currency is passed, script defaults to USD and symbol fUSD.