Bybit Exchange AI Trading Skill

• Outcome: Review
• Latest audit: Aug 7, 2026 · 10:23 AM UTC
• Version: 1.5.3

Overview

This Bybit trading skill is broadly legitimate, but it needs review because it can handle live trading credentials, move funds, store OAuth secrets, and update itself from remote sources.

Install only if you are comfortable giving an AI assistant access to a limited Bybit sub-account. Use testnet or a capped sub-account, never enable withdrawal permission, prefer local environment variables over pasting secrets into cloud chat, review any self-update/module download before using live credentials, and require a clear confirmation card for every mainnet action that moves funds, creates debt, follows a trader, enrolls in Earn, or places/changes orders.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (42)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill clearly expects environment-variable access (`BYBIT_API_KEY`, `BYBIT_API_SECRET`, RSA key paths) and instructs the agent to read them, but it declares no explicit permissions boundary. That creates hidden capability creep: a host may grant env access implicitly, and users or orchestrators are not clearly informed that the skill consumes local secrets.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The public description says this is a trading skill, but the content also adds OAuth login, token exchange, credential harvesting from Bybit, local token storage, and callback-server behavior. That mismatch reduces informed consent and can cause a user or platform to approve a skill for trading while unknowingly granting broader auth and secret-handling behaviors.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The README makes a strong security claim that secrets never leave the user's device, but it also instructs users of cloud AI platforms to provide credentials interactively to hosted assistants. In that deployment model, prompts and session memory may be transmitted to third-party servers, so the claim is materially misleading and can cause users to expose live trading credentials under false assumptions.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill advertises an automatic update path that fetches code and manifests from GitHub at session start, introducing a remote supply-chain execution path into a highly sensitive trading workflow. If the repository, manifest, or distribution path is compromised, users could silently receive modified logic that can alter trades, exfiltrate API keys, or disable safeguards.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to self-update by downloading remote content and replacing local files at session start. Even with checksum checks, this turns a trading skill into a remote code/content installation mechanism and expands the trust boundary to external infrastructure and manifest integrity.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The module router fetches remote module files on demand and persists them locally, effectively allowing the skill's behavior to change during a session. This adds dynamic installation capability unrelated to the immediate user request and increases exposure to supply-chain compromise or malicious content injection.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The document claims `oauth.js` is not delivered by auto-update, yet the auto-update rules permit downloading `.js` files listed in the manifest. This inconsistency can mislead reviewers about actual code-delivery paths and weakens trust in the security model around executable content.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This module materially expands the skill from exchange trading into prediction-market betting on real-world events, including geo-restricted and compliance-sensitive wagering flows, without that capability being reflected in the manifest description. Hidden or under-disclosed scope increases the chance that an orchestrator, reviewer, or end user invokes a regulated/high-risk feature without informed consent, appropriate policy gating, or marketplace review.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The module broadens the advertised capability from general Bybit trading into on-chain DEX execution and LP/farming, which introduce distinct risks such as smart-contract exposure, asynchronous settlement, token risk flags, and liquidity-pool operations. If these higher-risk functions are not accurately declared in metadata, security controls and user expectations may be bypassed, leading to unintended fund movement or approval of riskier workflows than the host anticipated.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The PWM institutional asset-manager section grants capabilities far beyond a normal end-user trading assistant, including fund creation, plan management, order approval, and sub-account operations. In an AI skill context, exposing these high-privilege administrative endpoints increases the chance that a vague or manipulated prompt could trigger sensitive actions that affect other users, managed funds, or institutional accounts.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The fund-transfer capability is especially dangerous because it enables direct movement of assets between user IDs, which is outside the stated purpose of a retail trading skill and highly sensitive. If exposed through natural-language activation without strong contextual and authorization controls, prompt confusion or abuse could lead to unauthorized transfers or laundering of funds between accounts.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The document declares one SHA256 as the single source of truth, but the actual procedure instructs operators to verify against a different hash value. That contradiction defeats the integrity guarantee: it can cause trusted code to be rejected or, worse, cause a different artifact to be accepted if the wrong checksum is followed during installation.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to automatically transfer funds from the Unified account to the Funding account when the bot balance is insufficient. Even though this is an internal account transfer, it is still a write action affecting user assets, and the instruction to auto-transfer creates a path for unintended fund movement without explicit transaction-specific consent at the moment of transfer.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The DCA create example sets `earn_enabled: true` by default, which can automatically enroll holdings into Earn. That extends the skill beyond trading-bot operation into an additional yield product, creating materially different custody, liquidity, and risk behavior that a user may not have intended or understood.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README tells users to instruct an AI assistant to fetch and install a remote skill from a raw GitHub URL, but it does not prominently warn that the remote content can change over time. This creates a prompt-driven remote code ingestion pattern where users may unknowingly authorize new behavior later, which is especially risky for a trading skill handling exchange credentials and write actions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The self-update description says updated files are downloaded automatically from GitHub, but it omits any strong safety warning about remote code changes in a credentialed trading context. That omission can normalize blind trust in mutable upstream content and reduce the chance that users apply proper controls before allowing updates.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger keywords include broad everyday terms like `buy`, `sell`, `transfer`, `card`, and `balance`, which can cause accidental activation in unrelated conversations. In a trading skill with write capabilities, overbroad routing increases the chance of unintended auth, module loading, or transaction preparation.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: OAuth activation phrases such as `authorize`, `login Bybit`, or `connect Bybit` are generic and can be triggered outside a clear consent flow. Because this path can lead to token exchange and credential storage, loose activation scope raises the risk of accidental or socially engineered authorization prompts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This module exposes authenticated fund-moving and liability-changing actions such as internal transfers, fixed-rate borrowing, and repayment, but does not prominently warn that these operations can move assets or create debt. In an AI skill context, that omission is risky because a model may present or execute these actions as routine account-help steps, increasing the chance of unintended financial loss or unauthorized borrowing if user intent is inferred too loosely.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This module documents many authenticated, state-changing financial actions such as loan repayment, collateral adjustment, borrow/supply placement, RFQ execution, spread order creation, and broker rate-limit changes without explicit warnings, confirmation requirements, or guidance to verify user intent before execution. In an AI trading skill context, that omission is dangerous because an agent could translate ambiguous natural-language prompts into irreversible or high-impact account actions, causing unintended trades, debt changes, collateral loss, or account configuration changes.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This module documents authenticated follow-binding endpoints that allocate user funds to copy trading based on a natural-language request, but it does not require a distinct confirmation step immediately before execution. In an AI-agent context, that omission is dangerous because an ambiguous, mistaken, or prompt-injected instruction could cause real funds to be committed to a leader/provider without the user clearly approving the exact trader and amount.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The module includes live order placement and position-closing instructions for copy-trading leaders, but it does not enforce an explicit user warning and confirmation before destructive trading actions. In a trading skill, these endpoints can open or close leveraged positions with real financial consequences, so a missing confirmation barrier materially increases the risk of accidental execution, misuse, or prompt-injection-driven trades.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Using the trigger phrase "Redeem" by itself is overly broad in a financial skill that supports multiple redemption actions affecting real assets. Ambiguous activation increases the risk that ordinary conversational text or unrelated requests could invoke a fund-moving workflow and cause the assistant to prepare or execute the wrong redemption path.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The Advance Earn activation examples include vague phrases like "future boost" and "leveraged position," which can overlap with unrelated trading intents. Because these products are complex and capital-bearing, weak intent scoping can route users into the wrong product flow or cause the assistant to present or place risky structured-product orders based on imprecise language.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: Liquidity Mining examples like "add liquidity," "remove liquidity," and "add margin" are broad phrases that may match unrelated DeFi, wallet, or exchange actions. In a skill able to move funds and alter leveraged positions, ambiguous routing raises the chance of invoking a sensitive workflow without sufficient confirmation or product scoping.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.