CoinAPI OpenAPI Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:29 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for read-only CoinAPI market data, but its default setup trusts a changeable remote API schema while using your CoinAPI key.

Review the UXC link command before installing. Prefer using the bundled local OpenAPI schema or an immutable, hash-verified schema URL, keep CoinAPI limits narrow, and monitor API quota or billing. Remove the UXC credential, binding, and CLI link if you no longer use the skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:64

Finding

Mutable Remote OpenAPI Schema Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16-17, SKILL.md:64-68, SKILL.md:97, references/usage-patterns.md:5-9, and references/usage-patterns.md:62-65
Vulnerability Type: Mutable, unverified remote dependency
Risk Level: Medium

Vulnerable Code

SKILL.md:16-17:

markdown

- Access to the curated OpenAPI schema URL:
  - `https://raw.githubusercontent.com/holon-run/uxc/main/skills/coinapi-openapi-skill/references/coinapi-market.openapi.json`

SKILL.md:64-68:

markdown

1. Use the fixed link command by default:
   - `command -v coinapi-openapi-cli`
   - If missing, create it:
     `uxc link coinapi-openapi-cli https://rest.coinapi.io --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/coinapi-openapi-skill/references/coinapi-market.openapi.json`
   - `coinapi-openapi-cli -h`

SKILL.md:97:

markdown

- `coinapi-openapi-cli <operation> ...` is equivalent to `uxc https://rest.coinapi.io --schema-url <coinapi_openapi_schema> <operation> ...`.

references/usage-patterns.md:5-9:

bash

command -v coinapi-openapi-cli
uxc link coinapi-openapi-cli https://rest.coinapi.io \
  --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/coinapi-openapi-skill/references/coinapi-market.openapi.json
coinapi-openapi-cli -h

references/usage-patterns.md:62-65:

markdown

## Fallback Equivalence

- `coinapi-openapi-cli <operation> ...` is equivalent to
  `uxc https://rest.coinapi.io --schema-url <coinapi_openapi_schema> <operation> ...`.

Technical Analysis

The documented setup retrieves the OpenAPI schema from the mutable GitHub main branch. No immutable commit identifier, release tag, content digest, or signature verification is specified. Consequently, the schema consumed when a user creates the CLI may differ from the local schema that was included in and revie ...[truncated 2398 chars]

Remediation

View remediation

Remediation Suggestions

1. Use the bundled schema by default:

   bash

   uxc link coinapi-openapi-cli https://rest.coinapi.io \
     --schema-url ./references/coinapi-market.openapi.json
   

   If UXC requires a different syntax for local files, use the corresponding local-file option and document the exact command.

2. If remote retrieval is operationally necessary, replace the main branch URL with a URL pinned to an immutable Git commit.

3. Publish the expected SHA-256 digest and verify the downloaded schema before passing it to UXC. Abort setup if verification fails.

4. Validate the schema after retrieval using an allowlist that enforces:

   • The server URL is exactly https://rest.coinapi.io.
   • Only the five documented paths are present.
   • Only the GET method is allowed.
   • Authentication uses the X-CoinAPI-Key header.
   • No external references or unexpected server overrides are present.

5. Update scripts/validate.sh to verify that documentation uses either the local schema or an immutable, integrity-checked remote source.

6. Review and rotate the pinned schema through an explicit release process rather than automatically trusting changes made to a mutable branch.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description says the skill operates CoinAPI market-data reads through UXC with authentication and read-oriented guardrails. The actual code chunk only validates that the skill package is correctly structured and documented: it checks required files, verifies schema JSON contents, and searches SKILL/openai/usage files for required strings such as link commands, auth header setup, and read-only language. This is a materially different primary purpose. While the script supports the claimed skill by enforcing its packaging and guardrails, the code itself does not implement CoinAPI reads, authentication behavior, or API access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.