Kraken OpenAPI Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:21 AM UTC
• Version: 1.0.0

Overview

The skill is documented as public, read-only Kraken market data, but it also bundles an undeclared private account and trading API schema and links a mutable remote schema at setup time.

Review this skill before installing. It is suitable only if you keep it limited to public Kraken market-data reads, avoid providing Kraken API keys, and verify that UXC is linked to a pinned public-only schema. The bundled private schema should be removed or split into a separate explicitly reviewed trading skill with confirmation gates.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/kraken-spot-futures.openapi.json:197

Finding

Bundled Schema Exposes Undeclared Private Trading Operations

Content

View full analysis

Vulnerability Details

File Location: references/kraken-spot-futures.openapi.json:197-294
Vulnerability Type: Undeclared privileged API surface
Risk Level: Medium

The project declares itself public-data-only and read-only in SKILL.md, but it bundles an additional OpenAPI schema containing private order-placement and order-cancellation operations.

json

"/0/private/AddOrder": {
  "post": {
    "operationId": "addOrder",
    "summary": "Place an order",
    "requestBody": {
      "required": true,
      "content": {
        "application/x-www-form-urlencoded": {
          "schema": {
            "allOf": [
              {
                "$ref": "#/components/schemas/NonceOnlyRequest"
              },
              {
                "type": "object",
                "required": [
                  "pair",
                  "type",
                  "ordertype",
                  "volume"
                ],
                "properties": {
                  "pair": {
                    "type": "string"
                  },
                  "type": {
                    "type": "string",
                    "enum": [
                      "buy",
                      "sell"
                    ]
                  },
                  "ordertype": {
                    "type": "string",
                    "enum": [
                      "market",
                      "limit"
                    ]
                  },
                  "price": {
                    "type": "string"
                  },
                  "volume": {
                    "type": "string"
                  },
                  "validate": {
                    "type": "boolean"
                  }
                }
              }
            ]
          }
        }
      }
    },
    "responses": {
      "200": {
        "description": 
...[truncated 3151 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove references/kraken-spot-futures.openapi.json from this public-data-only Skill.
2. If private operations are intentional, move them into a separate, explicitly named and separately reviewed Skill.
3. Require explicit user confirmation immediately before every order-placement or order-cancellation request.
4. Default order creation to Kraken's validation-only mode where supported, and require a separate confirmation before live submission.
5. Document and enforce least-privilege API keys, including disabling withdrawal rights and granting trading rights only when necessary.
6. Extend scripts/validate.sh to enumerate every bundled OpenAPI document and fail if a public-only package contains paths matching /0/private/.
7. Add automated checks ensuring that only allowlisted HTTP methods and public endpoint paths are exposed.
8. Never log API secrets, signatures, nonces, balances, positions, or complete private API responses.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:44

Finding

Runtime Schema Is Retrieved from a Mutable Upstream Branch

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:44-47
Additional Location: references/usage-patterns.md:5-9
Vulnerability Type: Unpinned remote dependency
Risk Level: Medium

The recommended setup command retrieves the effective OpenAPI schema from the mutable main branch of an external GitHub repository.

markdown

1. Use the fixed link command by default:
   - `command -v kraken-openapi-cli`
   - If missing, create it:
     `uxc link kraken-openapi-cli https://api.kraken.com --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/kraken-openapi-skill/references/kraken-public.openapi.json`
   - `kraken-openapi-cli -h`

The same behavior is repeated in references/usage-patterns.md:

bash

command -v kraken-openapi-cli
uxc link kraken-openapi-cli https://api.kraken.com \
  --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/kraken-openapi-skill/references/kraken-public.openapi.json
kraken-openapi-cli -h

Technical Analysis

The reviewed package contains a local schema, but the documented runtime workflow does not use it. Instead, UXC is instructed to retrieve a schema from a URL containing the mutable main branch reference. The content consumed at execution time can therefore differ from the version included in and reviewed with this package.

If the upstream repository, account, branch, or publishing process is compromised—or if the upstream schema is changed unintentionally—the API operations and parameters exposed by the generated client can change without any modification to the audited Skill. HTTPS protects the connection in transit but does not make mutable upstream content immutable or guarantee that it still matches the reviewed artifact.

The retrieved object is an OpenAPI schema rather than a shell program. Therefore, no direct remote native-code execution was established. The security concern is supply-chain substitution of ...[truncated 1376 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer the audited schema bundled in references/kraken-public.openapi.json.
2. If remote retrieval is required, pin the URL to an immutable Git commit rather than main.
3. Publish and verify a SHA-256 digest before passing the downloaded schema to UXC.
4. Reject schemas whose server origin, path set, or HTTP methods differ from a strict allowlist.
5. Update validation to confirm that the documented schema reference is immutable and matches the bundled artifact.
6. Review upstream changes before updating the pinned commit and digest.
7. Preserve the public-only restriction by automatically rejecting private paths and non-GET operations.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill metadata says it operates Kraken public market APIs, but the schema exposes private endpoints for balances, positions, and live trading actions such as AddOrder and CancelOrder. This creates a misleading trust boundary and could cause an agent or user to authorize or invoke sensitive account operations when they expected read-only market access.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

AddOrder and CancelOrder can execute real trades or alter live positions, yet the schema provides no warning that these operations affect funds and require deliberate user consent. In an agent workflow, missing user-facing danger cues can lead to accidental or socially engineered trade execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description claims a market-data-oriented schema but also includes balances, orders, and open positions, which are materially different and more sensitive capabilities. This mismatch can mislead downstream tooling, reviewers, or users about the skill's true authority and increase the chance of unsafe invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The private endpoints are described broadly and lack clear constraints about when they may be used, who may authorize them, and what kinds of requests must not trigger them. In an agent setting, that broad schema increases the chance that ordinary crypto-related prompts get matched to sensitive account or trading operations.

Content

No source excerpt is available for this finding.