T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:14
- Finding
- Mutable Remote OpenAPI Schema Controls Authenticated Financial Operations## Vulnerability Details **File Location**: `SKILL.md:14-15`, `SKILL.md:67-68`, and `references/usage-patterns.md:6-7` **Vulnerability Type**: Unpinned remote dependency used to define authenticated API operations **Risk Level**: Medium **Affected code in `SKILL.md:14-15`:** ```markdown - Access to the curated OpenAPI schema URL: - `https://raw.githubusercontent.com/holon-run/uxc/main/skills/mexc-openapi-skill/references/mexc-spot.openapi.json` ``` **Affected code in `SKILL.md:67-68`:** ```markdown - If missing, create it: `uxc link mexc-openapi-cli https://api.mexc.com --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/mexc-openapi-skill/references/mexc-spot.openapi.json` ``` **Affected code in `references/usage-patterns.md:6-7`:** ```bash uxc link mexc-openapi-cli https://api.mexc.com \ --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/mexc-openapi-skill/references/mexc-spot.openapi.json ``` ### Technical Analysis The normal setup procedure instructs users to retrieve the OpenAPI schema from the mutable Git branch `holon-run/uxc/main`. It does not pin the dependency to an immutable commit, verify a cryptographic digest, or compare the downloaded schema against the schema bundled in the audited project. The schema defines which HTTP paths, methods, and parameters are available through `mexc-openapi-cli`. The Skill also configures a signer binding for `https://api.mexc.com/api/v3`, allowing supported requests to be authenticated with the user's MEXC API key and secret. Consequently, the effective API surface used at runtime can change after the Skill package has been reviewed. This is a supply-chain trust issue rather than evidence that the current remote schema is malicious. Exploitation requires the upstream repository, branch, account, or delivery path to be compromised or changed unsafely. The fixed HTTPS MEXC base URL limits arbitrary-host credential exfilt ...[truncated 1805 chars]
- Remediation
- ## Remediation Suggestions 1. Use the bundled `references/mexc-spot.openapi.json` file by default instead of downloading a runtime schema. 2. If remote retrieval is required, pin the URL to a specific immutable Git commit rather than the `main` branch. 3. Publish the expected SHA-256 digest and verify the downloaded file before passing it to UXC. 4. Reject schemas whose server URL is not exactly `https://api.mexc.com`. 5. Validate the schema against an explicit allowlist of approved path and method pairs: - Public `GET` operations listed by the Skill. - Signed account and order `GET` operations listed by the Skill. - Only the approved `POST /api/v3/order` and `DELETE /api/v3/order` write operations. 6. Fail closed if the schema introduces additional servers, paths, methods, callbacks, external references, or unexpected authentication definitions. 7. Preserve the existing explicit-confirmation requirement for signed writes and display the exact HTTP method, path, symbol, side, quantity, and price before approval. 8. Configure MEXC API keys with the minimum required permissions and disable withdrawal or transfer permissions when they are not needed.