Skillv1.0.4

ClawScan security

Bybit AI Trading Skill · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 30, 2026, 9:13 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This skill is deprecated and contains only a short deprecation notice and a link; it does not request credentials, install software, or perform any actions.
Guidance: This skill is inert: it only displays a deprecation notice and a link to a replacement. Installing it poses no direct risk because it requests no credentials and contains no code. If you intend to use the suggested replacement, verify the replacement skill's publisher and review its SKILL.md and required environment variables carefully—trading skills commonly require exchange API keys that can control funds. Only grant API keys with the minimum scopes necessary, prefer scoped/revocable keys, and install skills from trusted/verified sources.

Purpose & Capability: noteThe name/description indicate a Bybit trading skill, but the SKILL.md contains only a deprecation message and a link to a replacement. There are no capabilities, commands, or requirements present. This is coherent for a deprecated placeholder but not a functioning trading skill.
Instruction Scope: okThe runtime instructions consist solely of a deprecation notice and a URL; they do not instruct the agent to read files, access environment variables, call external services, or perform actions beyond showing the message.
Install Mechanism: okNo install spec and no code files are present. Nothing would be written to disk or installed by this skill.
Credentials: noteThe skill declares no required environment variables or credentials. (As a reminder, a real trading skill would normally require exchange API keys—this deprecated placeholder does not.)
Persistence & Privilege: okDefault invocation flags are unchanged (not always: true). The skill does not request persistent presence or modify configurations.