mexc-openapi-skill
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads its curated OpenAPI specification from the vendor's repository at
https://raw.githubusercontent.com/holon-run/uxc/main/skills/mexc-openapi-skill/references/mexc-spot.openapi.jsonto configure theuxcCLI tool. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external MEXC API endpoints which could potentially be manipulated to influence agent behavior.
- Ingestion points: Responses from market data and account status operations (e.g.,
get:/api/v3/ticker/price,get:/api/v3/account) defined inreferences/mexc-spot.openapi.json. - Boundary markers: The skill encourages parsing JSON fields but lacks explicit boundary markers or instructions to treat external data as untrusted content.
- Capability inventory: The skill has capabilities to perform network requests and manage financial orders (create and delete) through the
uxccommand-line utility. - Sanitization: No documentation exists within the skill regarding the sanitization or validation of content returned from the MEXC API before it is processed by the agent.
Audit Metadata