Blockscout OpenAPI Skill

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:29 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent read-only Blockscout API helper, with one setup caveat around using a mutable remote schema URL.

Before installing, prefer linking UXC to the bundled schema file or a pinned commit URL instead of the mutable GitHub main-branch schema. Use host-specific auth only for Blockscout instances you trust, and keep usage to the documented GET/read operations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:42

Finding

Mutable Remote OpenAPI Schema Creates a Supply-Chain Trust Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16-17, 42-44, 82-83; references/usage-patterns.md:5-9, 46-49
Vulnerability Type: Mutable third-party dependency without version or integrity pinning
Risk Level: Medium

The setup instructions direct UXC to retrieve an OpenAPI schema from the mutable main branch of an external GitHub repository, even though an audited schema is included locally in references/blockscout-v2.openapi.json.

Complete affected setup command from SKILL.md:42-44:

bash

command -v blockscout-openapi-cli
# If missing, create it:
uxc link blockscout-openapi-cli https://eth.blockscout.com/api/v2 --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/blockscout-openapi-skill/references/blockscout-v2.openapi.json

The same mutable dependency is used for relinking in SKILL.md:81-83:

bash

uxc link blockscout-openapi-cli https://optimism.blockscout.com/api/v2 \
  --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/blockscout-openapi-skill/references/blockscout-v2.openapi.json

It is repeated in references/usage-patterns.md:5-9:

bash

command -v blockscout-openapi-cli
uxc link blockscout-openapi-cli https://eth.blockscout.com/api/v2 \
  --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/blockscout-openapi-skill/references/blockscout-v2.openapi.json
blockscout-openapi-cli -h

Technical Analysis

A URL referencing GitHub's main branch does not identify immutable content. The schema downloaded when a user installs or links the command may therefore differ from the schema that was present during this audit. No commit identifier, release version, cryptographic digest, or signature is used to establish integrity.

UXC uses this external schema to define the API operations and request parameters exposed through blockscout-openapi-cli. Consequently, an upstream repository compromise or uninten ...[truncated 2087 chars]

Remediation

View remediation

Remediation Suggestions

1. Use the schema bundled with the Skill as the default source instead of downloading it at runtime:

   bash

   uxc link blockscout-openapi-cli https://eth.blockscout.com/api/v2 \
     --schema-url /absolute/path/to/references/blockscout-v2.openapi.json
   

2. If remote retrieval is operationally required, pin the raw GitHub URL to a full immutable commit hash rather than main.
3. Publish and verify a SHA-256 digest or a cryptographic signature before passing a downloaded schema to UXC.
4. Update every occurrence in SKILL.md and references/usage-patterns.md so that fallback and multi-instance examples use the same pinned source.
5. Extend scripts/validate.sh to reject schema URLs containing mutable branch names such as /main/ or /master/.
6. Validate the effective schema before linking: allow only the expected Blockscout host, the seven approved paths, and the HTTP GET method.
7. Review dependency updates explicitly and update the pinned commit and integrity digest only after the new schema has passed security review.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose describes an end-user skill for reading from Blockscout through UXC with host selection and read-only safeguards. The supplied code does not perform Blockscout API operations, host selection, or UXC runtime interaction beyond checking that documentation contains certain command examples. Instead, it is a repository validation script that enforces required files, expected OpenAPI schema structure, and specific text patterns in SKILL.md and YAML/reference files. That is a materially different primary purpose from operating the explorer, so this is a description/behavior mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This JSON manifest describes the skill as a general 'Curated read-only Blockscout explorer surface for UXC' but provides no explicit trigger phrases, activation conditions, or exclusion criteria. For manifest files, the absence of specific invocation scope can create ambiguity about when the skill should be selected versus other blockchain or explorer-related skills.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.