ClawHub
Back to skill

Security audit

MEXC OpenAPI Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for MEXC spot trading, but it asks users to wire real exchange credentials to a mutable remote API schema that can define authenticated financial actions after review.

Install only if you are comfortable connecting an agent to a real MEXC Spot account. Prefer using the bundled schema or a commit-pinned, hash-verified schema, use API keys with the minimum needed permissions, disable withdrawal/transfer permissions, and require manual confirmation before any order placement or cancellation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Mutable Remote OpenAPI Schema Controls Authenticated Financial Operations

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:14-15, SKILL.md:67-68, and references/usage-patterns.md:6-7
Vulnerability Type: Unpinned remote dependency used to define authenticated API operations
Risk Level: Medium

Affected code in SKILL.md:14-15:

markdown
- Access to the curated OpenAPI schema URL:
  - `https://raw.githubusercontent.com/holon-run/uxc/main/skills/mexc-openapi-skill/references/mexc-spot.openapi.json`

Affected code in SKILL.md:67-68:

markdown
- If missing, create it:
  `uxc link mexc-openapi-cli https://api.mexc.com --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/mexc-openapi-skill/references/mexc-spot.openapi.json`

Affected code in references/usage-patterns.md:6-7:

bash
uxc link mexc-openapi-cli https://api.mexc.com \
  --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/mexc-openapi-skill/references/mexc-spot.openapi.json

Technical Analysis

The normal setup procedure instructs users to retrieve the OpenAPI schema from the mutable Git branch holon-run/uxc/main. It does not pin the dependency to an immutable commit, verify a cryptographic digest, or compare the downloaded schema against the schema bundled in the audited project.

The schema defines which HTTP paths, methods, and parameters are available through mexc-openapi-cli. The Skill also configures a signer binding for https://api.mexc.com/api/v3, allowing supported requests to be authenticated with the user's MEXC API key and secret. Consequently, the effective API surface used at runtime can change after the Skill package has been reviewed.

This is a supply-chain trust issue rather than evidence that the current remote schema is malicious. Exploitation requires the upstream repository, branch, account, or delivery path to be compromised or changed unsafely. The fixed HTTPS MEXC base URL limits arbitrary-host credential exfilt ...[truncated 1805 chars]

Remediation
View remediation

Remediation Suggestions

  1. Use the bundled references/mexc-spot.openapi.json file by default instead of downloading a runtime schema.
  2. If remote retrieval is required, pin the URL to a specific immutable Git commit rather than the main branch.
  3. Publish the expected SHA-256 digest and verify the downloaded file before passing it to UXC.
  4. Reject schemas whose server URL is not exactly https://api.mexc.com.
  5. Validate the schema against an explicit allowlist of approved path and method pairs:
    • Public GET operations listed by the Skill.
    • Signed account and order GET operations listed by the Skill.
    • Only the approved POST /api/v3/order and DELETE /api/v3/order write operations.
  6. Fail closed if the schema introduces additional servers, paths, methods, callbacks, external references, or unexpected authentication definitions.
  7. Preserve the existing explicit-confirmation requirement for signed writes and display the exact HTTP method, path, symbol, side, quantity, and price before approval.
  8. Configure MEXC API keys with the minimum required permissions and disable withdrawal or transfer permissions when they are not needed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The OpenAPI surface includes signed endpoints for account access and live order management such as account retrieval, order creation, and order cancellation, but the schema description provides no explicit warning that these operations can affect real funds or expose sensitive account state. In an agent/tooling context, that omission increases the risk of accidental live trading or unintended account-impacting actions because downstream consumers may treat these operations like ordinary data-fetching calls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation includes live trading write operations for placing and canceling orders without any explicit warning that these commands act on a real exchange account and can trigger irreversible financial actions. In a skill that is meant to be used by agents or operators, omission of safety prompts and sandbox/testnet guidance materially increases the risk of accidental order placement or cancellation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md
rg -q -- '--signer-json' "${SKILL_FILE}" "${USAGE_FILE}" || fail 'missing signer-json guidance'
rg -q 'X-MEXC-APIKEY' "${SKILL_FILE}" "${USAGE_FILE}" || fail 'missing API key header guidance'
rg -q 'high-risk' "${SKILL_FILE}" || fail 'missing write guardrail'
rg -q 'uxc auth binding match https://api.mexc.com/api/v3/account' "${SKILL_FILE}" || fail 'missing binding match example'
rg -q '^\s*display_name:\s*"MEXC Spot"\s*$' "${OPENAI_FILE}" || fail 'missing display_name'
rg -q '^\s*default_prompt:\s*".*\$mexc-openapi-skill.*"\s*$' "${OPENAI_FILE}" || fail 'default_prompt must mention $mexc-openapi-skill'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/usage-patterns.md (reported line 35)May include surrounding context.

md
rg -q -- '--signer-json' "${SKILL_FILE}" "${USAGE_FILE}" || fail 'missing signer-json guidance'
rg -q 'X-MEXC-APIKEY' "${SKILL_FILE}" "${USAGE_FILE}" || fail 'missing API key header guidance'
rg -q 'high-risk' "${SKILL_FILE}" || fail 'missing write guardrail'
rg -q 'uxc auth binding match https://api.mexc.com/api/v3/account' "${SKILL_FILE}" || fail 'missing binding match example'
rg -q '^\s*display_name:\s*"MEXC Spot"\s*$' "${OPENAI_FILE}" || fail 'missing display_name'
rg -q '^\s*default_prompt:\s*".*\$mexc-openapi-skill.*"\s*$' "${OPENAI_FILE}" || fail 'default_prompt must mention $mexc-openapi-skill'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/validate.sh (reported line 36)May include surrounding context.

sh
rg -q -- '--signer-json' "${SKILL_FILE}" "${USAGE_FILE}" || fail 'missing signer-json guidance'
rg -q 'X-MEXC-APIKEY' "${SKILL_FILE}" "${USAGE_FILE}" || fail 'missing API key header guidance'
rg -q 'high-risk' "${SKILL_FILE}" || fail 'missing write guardrail'
rg -q 'uxc auth binding match https://api.mexc.com/api/v3/account' "${SKILL_FILE}" || fail 'missing binding match example'
rg -q '^\s*display_name:\s*"MEXC Spot"\s*$' "${OPENAI_FILE}" || fail 'missing display_name'
rg -q '^\s*default_prompt:\s*".*\$mexc-openapi-skill.*"\s*$' "${OPENAI_FILE}" || fail 'default_prompt must mention $mexc-openapi-skill'