Bybit OpenAPI Skill

Operate Bybit V5 public market APIs through UXC with a curated OpenAPI schema, market-first discovery, and explicit private-auth boundary notes.

Security Scan

The skill's files and runtime instructions match its stated purpose (read-only Bybit V5 public market access); only minor bookkeeping omissions (undeclared required tools) should be noted before use.

Purpose & Capability

The skill's name, description, OpenAPI schema, usage examples, and SKILL.md all consistently describe read-only Bybit V5 public market access. One inconsistency: SKILL.md requires the 'uxc' CLI to be installed and on PATH, but the registry metadata lists no required binaries. The included validation script also depends on jq and rg (ripgrep) for local validation. These missing declarations look like bookkeeping omissions rather than functional mismatches, but you should ensure those tools are present before running.

Instruction Scope

Runtime instructions are narrowly scoped to public GET/read operations against Bybit's market endpoints and to creating/using a local 'bybit-openapi-cli' via 'uxc link'. The SKILL.md explicitly forbids private-auth operations and urges read-only behavior. It does not instruct reading unrelated files or exfiltrating data to non-Bybit endpoints.

Install Mechanism

There is no install spec (instruction-only skill), which minimizes risk. The only external URL referenced is a raw.githubusercontent.com link hosting the curated OpenAPI schema — a standard, transparent location. The included validate.sh is a local helper that requires jq and rg if you run it; it does not perform any network installs itself.

Credentials

The skill declares no environment variables or credentials and the SKILL.md clearly states public market endpoints do not require auth. No unrelated credential or secret access is requested. The guidance to keep this v1 skill public-data-only is explicit.

Persistence & Privilege

The skill is not always-enabled and can be invoked by users. It does instruct using 'uxc link' to create a local 'bybit-openapi-cli' command — that will create a local CLI wrapper via the user's uxc installation (i.e., it can add a command to the environment). This is expected for a CLI-centered workflow but you should confirm what 'uxc link' does on your system before running it.

Scan Findings in Context

[no_scan_findings] expected: Static pre-scan reported no injection signals or flagged patterns. The project contains only a curated OpenAPI JSON, docs, and a validation script, so lack of findings is consistent with its instruction-only, read-only design.

Assessment

This skill appears coherent and limited to public read-only Bybit market APIs, but check a few practical things before installing/using: (1) Make sure you have the 'uxc' CLI installed and understand what 'uxc link' will create on your system (it may add a local bybit-openapi-cli wrapper). (2) The included validate.sh is optional but requires jq and ripgrep if you want to run it locally. (3) The skill intentionally avoids private/auth endpoints — do not provide Bybit API keys to this skill unless a vetted signer flow is added later. (4) Confirm you allow network access to api.bybit.com and raw.githubusercontent.com. If any of these points are unexpected, pause and review 'uxc' documentation and the local schema file before proceeding.

Bybit V5 Skill

Use this skill to run Bybit V5 market-data operations through uxc + OpenAPI.

Reuse the uxc skill for shared execution, auth, and error-handling guidance.

Prerequisites

• uxc is installed and available in PATH.
• Network access to:
  • https://api.bybit.com
  • optionally https://api-testnet.bybit.com
• Access to the curated OpenAPI schema URL:
  • https://raw.githubusercontent.com/holon-run/uxc/main/skills/bybit-openapi-skill/references/bybit-v5.openapi.json

Scope

This skill covers a curated Bybit V5 public market surface for:

• server time
• instruments metadata
• tickers
• order book snapshots
• kline reads

This skill does not cover:

• private account endpoints in v1
• private order placement or cancellation in v1
• copy trading, earn, broker, or asset management product families

Authentication

Public market endpoints in this skill do not require credentials.

Bybit private APIs use provider-specific header signing that is not yet packaged as a generic uxc signer flow. Keep this v1 skill public-data-only until a reusable Bybit signer path exists.

Region Guardrail

Bybit's official docs note region and IP restrictions. If requests fail unexpectedly, verify that the current execution environment is permitted for Bybit API access before debugging the schema or parameters.

Core Workflow

1. Use the fixed link command by default:

   • command -v bybit-openapi-cli
   • If missing, create it: uxc link bybit-openapi-cli https://api.bybit.com --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/bybit-openapi-skill/references/bybit-v5.openapi.json
   • bybit-openapi-cli -h

2. Inspect operation help before execution:

   • bybit-openapi-cli get:/v5/market/time -h
   • bybit-openapi-cli get:/v5/market/instruments-info -h
   • bybit-openapi-cli get:/v5/market/tickers -h

3. Prefer narrow spot reads first:

   • bybit-openapi-cli get:/v5/market/tickers category=spot symbol=BTCUSDT
   • bybit-openapi-cli get:/v5/market/orderbook category=spot symbol=BTCUSDT limit=20

Operations

• get:/v5/market/time
• get:/v5/market/instruments-info
• get:/v5/market/tickers
• get:/v5/market/orderbook
• get:/v5/market/kline

Guardrails

• Keep automation on the JSON output envelope; do not use --text.
• Parse stable fields first: ok, kind, protocol, data, error.
• Treat this v1 skill as read-only.
• Use category=spot unless the user explicitly needs another market family and has checked the symbol format.
• bybit-openapi-cli <operation> ... is equivalent to uxc https://api.bybit.com --schema-url <bybit_v5_openapi_schema> <operation> ....

References

• Usage patterns: references/usage-patterns.md
• Curated OpenAPI schema: references/bybit-v5.openapi.json
• Official Bybit V5 docs: https://bybit-exchange.github.io/docs/v5/guide