kucoin-openapi-skill
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a curated OpenAPI schema from a remote source at
https://raw.githubusercontent.com/holon-run/uxc/main/skills/kucoin-openapi-skill/references/kucoin-public.openapi.json. This is a vendor-controlled resource used to define the API interface for theuxctool. - [COMMAND_EXECUTION]: The skill executes local commands using
uxcto link a CLI alias (kucoin-openapi-cli) and to perform market data queries. These commands are restricted to public GET requests as defined in the provided OpenAPI schema. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external KuCoin API endpoints (symbols, tickers, order books, and candles). While this represents an external data ingestion surface, the skill implements guardrails by requiring structured JSON output and focusing on stable financial data fields, which reduces the risk of interpreting data as instructions.
Audit Metadata