Bitget OpenAPI Skill

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:21 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed, read-only Bitget public market-data helper, with a minor supply-chain caution around its remote schema URL.

Before installing, understand that this skill is intended for public Bitget market data only. Prefer using the bundled schema or a pinned schema URL if your environment requires reproducible reviewed behavior; do not extend it to private account or trading actions without a separate signer and review.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:34
• Finding: Mutable Remote OpenAPI Schema Trusted During CLI Creation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:34-38` and `references/usage-patterns.md:5-9` **Vulnerability Type**: Supply-chain risk caused by an unpinned remote schema **Risk Level**: Medium ### Vulnerable Code `SKILL.md:34-38`: ```markdown 1. Use the fixed link command by default: - `command -v bitget-openapi-cli` - If missing, create it: `uxc link bitget-openapi-cli https://api.bitget.com --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/bitget-openapi-skill/references/bitget-v2.openapi.json` - `bitget-openapi-cli -h` ``` `references/usage-patterns.md:5-9`: ```bash command -v bitget-openapi-cli uxc link bitget-openapi-cli https://api.bitget.com \ --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/bitget-openapi-skill/references/bitget-v2.openapi.json bitget-openapi-cli -h ``` ### Technical Analysis The setup instructions direct `uxc link` to consume an OpenAPI schema from the mutable `main` branch of an external GitHub repository. The remote resource is not pinned to an immutable commit, and the skill does not require verification of a checksum or cryptographic signature. As a result, the schema used to create `bitget-openapi-cli` can change after this skill package has been reviewed. It may also differ from the bundled and audited `references/bitget-v2.openapi.json` file. This creates a time-of-review versus time-of-use supply-chain weakness. The audited project does not establish that loading this schema directly executes arbitrary code. Therefore, the confirmed risk is limited to unauthorized modification of the schema-derived operation surface and generated HTTP request behavior; arbitrary local command execution, credential theft, or access to private Bitget operations cannot be claimed from the available evidence. ### Attack Path 1. An attacker compromises the upstream repository, an authorized maintainer account, or another mechanism capable of changing the sch ...[truncated 1364 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use the schema bundled with the reviewed skill package instead of downloading a mutable copy during CLI creation. 2. If remote retrieval is necessary, replace the `main` branch URL with a raw URL pinned to an immutable Git commit. 3. Publish an expected SHA-256 digest and verify the downloaded schema before passing it to `uxc link`. 4. Fail closed when the checksum or signature does not match; do not silently fall back to the mutable remote resource. 5. Extend `scripts/validate.sh` to reject schema URLs containing mutable branch references such as `/main/` and to verify that setup documentation uses the pinned artifact. 6. Review pinned schema updates as explicit dependency changes before updating the commit reference or expected digest. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.