Bitget OpenAPI Skill

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:21 PM UTC
• Version:
  1.0.0

Overview

This is a clearly scoped Bitget public market-data skill; the main caution is that it creates a reusable UXC link and depends on a remote schema URL.

Install only if you trust UXC and the referenced schema source. Keep usage to the documented public GET market-data operations, and do not add Bitget credentials or private trading endpoints without a separately reviewed signing/auth flow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a mismatch because the declared purpose describes an API-operation skill for Bitget public market access, but the actual code shown only performs static validation of skill packaging, docs, and schema files. It does not call Bitget APIs, operate UXC against the exchange, or provide market discovery behavior. The code's primary purpose is build/repository validation, which is materially different from the declared runtime functionality.

VirusTotal

66/66 vendors flagged this skill as clean.