mempool-space-openapi-skill
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a curated OpenAPI specification from the author's official GitHub repository (holon-run/uxc) to define the available API operations. This is a trusted vendor resource used for configuration.
- [COMMAND_EXECUTION]: Instructions guide the agent to use the uxc CLI tool to create a local command alias (mempool-space-openapi-cli) for interacting with the mempool.space API.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from the public mempool.space blockchain explorer.
- Ingestion points: Blockchain and Lightning network state data retrieved from https://mempool.space/api.
- Boundary markers: Instructions explicitly mandate using the JSON output envelope and parsing stable fields (ok, kind, protocol, data, error) to maintain structural integrity.
- Capability inventory: The skill uses the uxc utility to perform network requests; capabilities are scoped to read-only GET operations as defined in the curated schema.
- Sanitization: The skill relies on structural JSON parsing and provides guardrails against using text-based outputs or administrative routes.
Audit Metadata