bybit-exchange-trading-skill@1.5.3
VERIFIED· install onlyPublisher claims: "Bybit AI Trading Skill — Trade on Bybit using natural language. Covers spot, derivatives, earn, and more. Works with Claude, ChatGPT, OpenClaw, and any AI assistant." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-09 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
Paste into `~/.openclaw/.env` (recommended) or `./.env` in your working directory:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.…tstrap** section. The OAuth executable (`modules/oauth.js`) is NOT delivered by auto-update — it is lazy-fetched from raw.github with a SHA256-pinned check inside `oauth.md`. Without running Bootstrap first, every `node ... modules/oauth.j…Fix: Pin versions and sources; vendor anything fetched at install time.Keys stay on the user's machine — same security level as Path A. Configure via `.env` file:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.…executed its **Bootstrap** section. `oauth.js` is lazy-fetched (NOT shipped via auto-update manifest) — running `require('<skill_dir>/modules/oauth.js')` on a fresh install without Bootstrap will fail with `Cannot find module`. **Path …Fix: Pin versions and sources; vendor anything fetched at install time.On first use, check if these environment variables exist. If they do, use them directly. If they don't, guide the user to create `~/.openclaw/.env` with the variables above.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.| **Self-hosted OpenClaw** | Key stays on your machine (.env file) | Low | Safe for trading |Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.