Binance Web3 Openapi Skill

Operate Binance Web3 public market and research APIs through UXC with a curated OpenAPI schema. Use when tasks need token search, token metadata/market snaps...

Security Scan

The skill appears to implement read-only Binance Web3 API calls as described, but there are small inconsistencies (undeclared runtime prerequisites and developer checks) you should understand before installing.

Purpose & Capability

The skill's stated purpose (public read-only access to Binance Web3 endpoints via uxc + a curated OpenAPI schema) matches the included OpenAPI file and examples. However, the SKILL.md requires the 'uxc' tool and a host CLI alias (binance-web3-openapi-cli) at runtime even though the registry metadata lists no required binaries; the included validation script also expects 'rg' and 'jq'. This is likely an omission in metadata rather than malicious, but it is an inconsistency.

Instruction Scope

Runtime instructions are narrowly scoped to calling public Binance Web3 endpoints via uxc/binance-web3-openapi-cli, inspecting operation schemas, and passing operation-level headers where required. The instructions require network access to https://web3.binance.com and to the raw.githubusercontent.com schema URL. They do not instruct reading local secrets or other system files, nor do they request credentials. Note: some endpoints (address holdings) accept wallet addresses, which are sensitive user data and should be supplied deliberately by the user.

Install Mechanism

This is instruction-only (no install spec) and ships a local OpenAPI JSON copy. No downloads or archive extraction are performed by the skill itself. The only install-related artifact is a validation script (scripts/validate.sh) used by maintainers that requires 'rg' and 'jq'; this script does not appear to run at runtime for agents but does introduce a developer-time dependency.

Credentials

The skill does not declare any required environment variables or credentials, which is consistent with its use of public endpoints. There is no evidence in SKILL.md or code that it attempts to access unrelated secrets or environment variables.

Persistence & Privilege

The skill does not request permanent presence (always:false) and does not modify other skills or system-wide settings. It allows autonomous invocation (disable-model-invocation:false), which is normal for skills; no combination of broad privileges is present that would increase concern.

What to consider before installing

This skill is largely what it says: a read-only OpenAPI mapping to Binance Web3 public endpoints. Before installing, note that SKILL.md requires the 'uxc' CLI and the binance-web3-openapi-cli link — but the registry metadata doesn't list those binaries; install 'uxc' if you plan to use it. The skill needs network access to web3.binance.com and the raw GitHub schema URL (though a local schema copy is bundled). Be deliberate when supplying wallet addresses (they are sensitive). If you plan to run the included validate.sh, ensure you have ripgrep (rg) and jq available. If these undeclared prerequisites or network accesses are unacceptable in your environment, treat the mismatch as a reason to avoid or further audit the skill.

Binance Web3 API Skill

Use this skill to run Binance Web3 public read operations through uxc + OpenAPI.

Reuse the uxc skill for shared execution and error-handling guidance.

Prerequisites

• uxc is installed and available in PATH.
• Network access to https://web3.binance.com.
• Access to the curated OpenAPI schema URL:
  • https://raw.githubusercontent.com/holon-run/uxc/main/skills/binance-web3-openapi-skill/references/binance-web3.openapi.json

Scope

This skill covers the public web3.binance.com endpoints for:

• token search
• token metadata
• token market snapshots
• address holdings
• token security audit
• social hype leaderboard
• unified token ranks
• meme rush ranks
• smart money signals

This skill does not cover:

• Binance Spot / account trading APIs
• Binance Square posting
• K-line candles hosted on https://dquery.sintral.io

Authentication

Most operations are public and do not require API credentials.

Core Workflow

1. Use the fixed link command by default:

   • command -v binance-web3-openapi-cli
   • If missing, create it: uxc link binance-web3-openapi-cli https://web3.binance.com --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/binance-web3-openapi-skill/references/binance-web3.openapi.json
   • binance-web3-openapi-cli -h

2. Inspect operation schema first:

   • binance-web3-openapi-cli get:/bapi/defi/v5/public/wallet-direct/buw/wallet/market/token/search -h
   • binance-web3-openapi-cli post:/bapi/defi/v1/public/wallet-direct/security/token/audit -h

3. Execute operation:

   • key/value: binance-web3-openapi-cli get:/bapi/defi/v5/public/wallet-direct/buw/wallet/market/token/search keyword=bnb chainIds=56 orderBy=volume24h
   • positional JSON: binance-web3-openapi-cli post:/bapi/defi/v1/public/wallet-direct/buw/wallet/market/token/pulse/unified/rank/list '{"rankType":10,"chainId":"56","period":50,"page":1,"size":20}'

Operation Groups

Token Discovery And Market Snapshot

• Search tokens:
  • get:/bapi/defi/v5/public/wallet-direct/buw/wallet/market/token/search
• Fetch token metadata:
  • get:/bapi/defi/v1/public/wallet-direct/buw/wallet/dex/market/token/meta/info
• Fetch token market data:
  • get:/bapi/defi/v4/public/wallet-direct/buw/wallet/market/token/dynamic/info

Rankings And Signals

• Social hype leaderboard:
  • get:/bapi/defi/v1/public/wallet-direct/buw/wallet/market/token/pulse/social/hype/rank/leaderboard
• Unified token rank:
  • post:/bapi/defi/v1/public/wallet-direct/buw/wallet/market/token/pulse/unified/rank/list
• Meme rush rank:
  • post:/bapi/defi/v1/public/wallet-direct/buw/wallet/market/token/pulse/rank/list
• Smart money signals:
  • post:/bapi/defi/v1/public/wallet-direct/buw/wallet/web/signal/smart-money

Research

• Address holdings:
  • get:/bapi/defi/v3/public/wallet-direct/buw/wallet/address/pnl/active-position-list
• Token audit:
  • post:/bapi/defi/v1/public/wallet-direct/security/token/audit

Guardrails

• Keep automation on the JSON output envelope; do not use --text.
• Parse stable envelope fields first: ok, kind, protocol, data, error.
• Binance Web3 responses usually wrap payloads as code, message, success, data; treat code == "000000" as success.
• audit requires a UUID v4 requestId; generate one for every request instead of reusing old IDs.
• Address holdings requires operation-level headers clienttype=web and clientversion=1.2.0; keep them scoped to that operation instead of injecting them host-wide.
• For non-string objects, prefer positional JSON instead of flattening complex filters into many key=value args.
• binance-web3-openapi-cli <operation> ... is equivalent to uxc https://web3.binance.com --schema-url <binance_web3_openapi_schema> <operation> ....

References

• Usage patterns: references/usage-patterns.md
• Curated OpenAPI schema: references/binance-web3.openapi.json
• Binance skills hub source material: https://github.com/binance/binance-skills-hub/tree/main/skills/binance-web3