KuCoin OpenAPI Skill

Operate KuCoin public exchange market APIs through UXC with a curated OpenAPI schema, market-first discovery, and explicit private-auth boundary notes.

Security Scan

The skill is internally consistent with a read-only KuCoin public-market purpose; it doesn't request credentials and its instructions stay within that scope, though there are minor metadata omissions you should be aware of.

Purpose & Capability

The skill's name, description, SKILL.md, and included OpenAPI schema all align around read-only KuCoin public market data. However, the registry metadata lists no required binaries while SKILL.md explicitly requires the 'uxc' CLI in PATH. Also the included validation script (scripts/validate.sh) expects 'jq' and 'rg' (ripgrep) which are not declared in the top-level requirements — this is a packaging/metadata omission rather than a capability mismatch.

Instruction Scope

SKILL.md limits actions to public REST reads (symbols, tickers, orderbook, candles), instructs to keep outputs JSON/read-only, and explicitly warns not to use private/auth endpoints. It does not instruct reading unrelated files or environment variables nor sending data to unexpected endpoints. It does require network access to api.kucoin.com and to the raw GitHub-hosted schema URL.

Install Mechanism

No install spec — instruction-only skill — so nothing is automatically downloaded or written to disk. The provided schema is a static file in the skill and the SKILL.md points to a raw GitHub URL for the schema; that is a common, reasonable source for an OpenAPI schema in this context.

Credentials

The skill requests no environment variables, secrets, or credentials and its stated functionality (public market reads) does not require them. This is proportionate. The README explicitly warns against using private endpoints until a signer flow exists.

Persistence & Privilege

The skill does not request always:true or other privileged persistence. It is user-invocable and allows autonomous invocation (platform default) but the skill's scope is read-only, so autonomy here does not present an unexplained privilege escalation.

Assessment

This skill appears to do exactly what it says: provide read-only KuCoin public-market API access via a curated OpenAPI schema and the 'uxc' CLI. Before installing, verify you trust the 'uxc' binary (it must be on PATH per SKILL.md) and review the referenced schema (the skill includes a local copy and points to a raw.githubusercontent.com URL). Note the repository includes a validation script that expects 'jq' and 'rg' — those are developer/CI tools and are not required at runtime by the agent, but if you or your CI run that script you will need them installed. Finally, the skill is read-only and requests no credentials; if later versions add private endpoints, ensure they declare and justify any credential requirements.

KuCoin Unified API Skill

Use this skill to run KuCoin public market-data operations through uxc + OpenAPI.

Reuse the uxc skill for shared execution, auth, and error-handling guidance.

Prerequisites

• uxc is installed and available in PATH.
• Network access to https://api.kucoin.com.
• Access to the curated OpenAPI schema URL:
  • https://raw.githubusercontent.com/holon-run/uxc/main/skills/kucoin-openapi-skill/references/kucoin-public.openapi.json

Scope

This skill covers a curated KuCoin public market surface for:

• symbol discovery
• all tickers
• order book snapshots
• candlestick reads

This skill does not cover:

• private account or order endpoints in v1
• websocket, margin, or broader platform products

Authentication

Public market endpoints in this skill do not require credentials.

KuCoin private REST auth uses provider-specific headers and signing rules including passphrase handling. Keep this v1 skill public-data-only until a reusable KuCoin signer flow exists in uxc.

Core Workflow

1. Use the fixed link command by default:

   • command -v kucoin-openapi-cli
   • If missing, create it: uxc link kucoin-openapi-cli https://api.kucoin.com --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/kucoin-openapi-skill/references/kucoin-public.openapi.json
   • kucoin-openapi-cli -h

2. Inspect operation help before execution:

   • kucoin-openapi-cli get:/api/v1/symbols -h
   • kucoin-openapi-cli get:/api/v1/market/allTickers -h

3. Prefer narrow symbol reads first:

   • kucoin-openapi-cli get:/api/v1/market/orderbook/level2_20 symbol=BTC-USDT
   • kucoin-openapi-cli get:/api/v1/market/candles symbol=BTC-USDT type=1hour

Operations

• get:/api/v1/symbols
• get:/api/v1/market/allTickers
• get:/api/v1/market/orderbook/level2_20
• get:/api/v1/market/candles

Guardrails

• Keep automation on the JSON output envelope; do not use --text.
• Parse stable fields first: ok, kind, protocol, data, error.
• Treat this v1 skill as read-only.
• KuCoin symbols use dash-separated names such as BTC-USDT.
• kucoin-openapi-cli <operation> ... is equivalent to uxc https://api.kucoin.com --schema-url <kucoin_public_openapi_schema> <operation> ....

References

• Usage patterns: references/usage-patterns.md
• Curated OpenAPI schema: references/kucoin-public.openapi.json
• Official KuCoin auth docs: https://www.kucoin.com/docs-new/authentication