Chainbase OpenAPI Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:23 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed read-only Chainbase API helper, but its setup loads a changeable remote schema, so the generated CLI may differ from the reviewed package.

Review before installing. Prefer linking UXC to the bundled local schema or to an immutable, verified schema URL, and use a Chainbase API key with the least privileges available. Do not run broad wallet or token-holder crawls unless you are comfortable sending those identifiers to Chainbase.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:57

Finding

Mutable Remote OpenAPI Schema Weakens Supply-Chain Integrity

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:57-60; duplicated in references/usage-patterns.md:5-9
Vulnerability Type: Unpinned remote dependency
Risk Level: Medium

Vulnerable code in SKILL.md:

bash

1. Use the fixed link command by default:
   - `command -v chainbase-openapi-cli`
   - If missing, create it:
     `uxc link chainbase-openapi-cli https://api.chainbase.online --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/chainbase-openapi-skill/references/chainbase-web3.openapi.json`
   - `chainbase-openapi-cli -h`

Duplicated vulnerable code in references/usage-patterns.md:

bash

command -v chainbase-openapi-cli
uxc link chainbase-openapi-cli https://api.chainbase.online \
  --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/chainbase-openapi-skill/references/chainbase-web3.openapi.json
chainbase-openapi-cli -h

Technical Analysis

The generated CLI is linked using an OpenAPI schema downloaded from the mutable main branch of an external GitHub repository. No immutable commit reference, version tag with integrity verification, or cryptographic digest is specified.

The project includes a locally reviewable schema at references/chainbase-web3.openapi.json, but the documented runtime workflow does not use it. Consequently, the effective API definition used after installation can differ from the artifact reviewed during this audit.

If the upstream repository, account, branch, or delivery path is compromised, an attacker could alter the remotely supplied schema. Depending on UXC's schema processing behavior, this could change the available operations, request parameters, or request construction associated with the generated CLI. The reviewed local schema itself only defines seven GET operations and does not contain an executable payload.

Attack Path

1. An attacker obtains permission to modify the referenced upstrea ...[truncated 1637 chars]

Remediation

View remediation

Remediation Suggestions

1. Use the bundled schema as the default source:

   bash

   uxc link chainbase-openapi-cli https://api.chainbase.online \
     --schema-url ./references/chainbase-web3.openapi.json
   

2. If remote retrieval is required, pin the URL to an immutable Git commit rather than main:

   text

   https://raw.githubusercontent.com/holon-run/uxc/<full-commit-sha>/skills/chainbase-openapi-skill/references/chainbase-web3.openapi.json
   

3. Publish and verify a SHA-256 digest before passing the schema to UXC. Abort linking when verification fails.

4. Update scripts/validate.sh to ensure documentation does not reference mutable branches and that any remote schema digest matches the bundled schema.

5. Keep the API host allowlist and HTTPS credential binding. Additionally, validate that the loaded schema:

   • Uses only https://api.chainbase.online.
   • Contains only the intended seven GET operations.
   • Defines no write methods.
   • Retains X-API-KEY as the expected authentication header.

6. Apply the same corrected command in both SKILL.md and references/usage-patterns.md to prevent users from following an obsolete insecure setup path.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description says the skill operates Chainbase indexed wallet and token reads via UXC with API-key auth and read-first guardrails. However, the supplied code chunk does not perform any Chainbase API calls, UXC operations, wallet reads, or token reads. It is a local CI-style validator script that ensures required files exist and contain expected text/configuration. While those checks support the declared skill, the actual code's primary purpose is validation of packaging/documentation, not operation of the Chainbase integration itself. That is a material description-behavior mismatch for this specific code chunk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This JSON manifest describes HTTPS requests protected by an API key and several endpoints that transmit account addresses, contract addresses, and transaction hashes as query parameters. The file presents these network operations as read-only, but it does not include any description or warning that user-supplied identifiers will be sent to an external service or that an API credential is required.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes the skill as operating indexed wallet and token reads, which strongly suggests balances, token holdings, and similar direct lookup queries. The curated OpenAPI surface also exposes account transaction history (/v1/account/txs), transaction detail (/v1/tx/detail), and token holder enumeration (/v1/token/holders), which expand into broader blockchain analytics capabilities not clearly implied by that narrower description.

Content

No source excerpt is available for this finding.