← 返回 Skills 市场

Bybit AI Trading Skill

Name: Bybit AI Trading Skill
Author: woodliang

作者 woodliang · GitHub ↗ · v1.0.3 · MIT-0

cross-platform ⚠ suspicious

428

总下载

当前安装

版本数

在 OpenClaw 中安装

/install bybit-trading

功能描述

Bybit AI Trading Skill — Trade on Bybit using natural language. Covers spot, derivatives, earn, and more. Works with Claude, ChatGPT, OpenClaw, and any AI as...

使用说明 (SKILL.md)

Bybit Trading Skill (Bootstrap)

This is a lightweight loader. The full skill is hosted on Bybit's official GitHub repository.

Load the full skill

1. Fetch the full SKILL.md:
   curl -sf https://raw.githubusercontent.com/bybit-exchange/skills/main/SKILL.md
2. Read and follow ALL instructions in the fetched content (authentication, module loading, security rules, etc.)
3. If fetch fails: tell the user "Could not load Bybit Trading Skill. Please check your network connection or try again later."

IMPORTANT: Do NOT proceed with any trading operations using only this bootstrap file. You MUST load the full skill first.

安全使用建议

This SKILL.md is only a bootstrap that tells the agent to fetch and follow a remote SKILL.md from GitHub. Do not install or run it until you review the full fetched skill content. Before using: 1) Fetch the referenced SKILL.md yourself and inspect it (preferably from a pinned commit SHA, not raw main). 2) Verify the GitHub repository ownership (is it actually Bybit's official account?). 3) Check exactly which environment variables or API keys the full skill requests and whether they require withdrawal rights — provide only minimum scopes and prefer testnet keys first. 4) Look for any scripts, downloads, or instructions that run code, install binaries, or contact additional external endpoints. 5) If you must proceed, avoid giving keys with withdrawal permissions and use a dedicated, limited-permission API key. If you cannot audit the fetched content before the agent follows it, do not enable this skill.

功能分析

Type: OpenClaw Skill Name: bybit-trading Version: 1.0.3 The skill employs a 'bootstrap' pattern in SKILL.md that instructs the AI agent to fetch and execute instructions from a remote URL (https://raw.githubusercontent.com/bybit-exchange/skills/main/SKILL.md). This behavior is highly risky as it allows for dynamic remote prompt injection and execution of unverified instructions, bypassing static analysis of the skill bundle and potentially leading to unauthorized actions or data exfiltration if the remote source is compromised or malicious.

能力评估

⚠ Purpose & Capability

The skill claims to enable trading on Bybit but the bootstrap contains no declared environment variables, credentials, or config requirements (e.g., API keys) that a trading integration would need. Instead it defers to fetching a remote SKILL.md; that mismatch (claiming trading capability but not declaring required secrets) is incoherent.

⚠ Instruction Scope

The runtime instructions tell the agent to fetch a full SKILL.md from a remote URL and to 'Read and follow ALL instructions' there (including authentication and module loading). That grants the fetched document broad discretion to request credentials, modules, or actions at runtime — behavior that cannot be vetted from this bootstrap alone and is risky.

ℹ Install Mechanism

There is no install spec or local code; instead the bootstrap instructs a curl fetch from raw.githubusercontent.com (a well-known host). Fetching GitHub raw content at runtime is less risky than an arbitrary personal server, but pulling and executing instructions from a remote 'main' branch is brittle and can be changed upstream. The bootstrap gives no integrity checks (no pinned commit SHA or signature).

⚠ Credentials

A Bybit trading skill would normally require API keys and possibly other secrets; none are declared here. Because the bootstrap defers to the fetched document, it hides what credentials will be requested. The lack of a declared primary credential is disproportionate to the stated purpose and prevents pre-install review of what secrets will be needed.

ℹ Persistence & Privilege

always is false and the skill is user-invocable (normal). The bootstrap itself does not request persistent presence or elevated privileges, but by instructing the agent to follow remote instructions it may enable downstream behavior that does. This indirection increases risk if the fetched content requests persistent tokens or modifies agent settings.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install bybit-trading
安装完成后，直接呼叫该 Skill 的名称或使用 /bybit-trading 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.3

- This version is now a lightweight bootstrap loader. - The full Bybit Trading Skill is hosted externally; this file provides instructions to fetch it from Bybit's official GitHub repository. - No trading operations or features are available until the full skill is loaded. - If fetching the full skill fails, users are prompted to check their connection or try again later.

v1.0.2

Bybit AI Trading Skill version 1.0.2 - Expanded SKILL.md documentation, covering setup, security, and all supported modules/intents. - Clarifies secure credential handling for various platforms, including local, self-hosted, and cloud environments. - Adds detailed environment switching rules for Mainnet and Testnet, including user instructions and display conventions. - Lists supported features: spot, derivatives, earn, account, P2P, fiat, and more. - Provides real API endpoint examples for common trading and market data operations.

元数据

Slug bybit-trading

版本 1.0.3

许可证 MIT-0

累计安装 1

当前安装数 1

历史版本数 2

常见问题