← Back to Skills Marketplace
268
Downloads
0
Stars
1
Active Installs
1
Versions
Install in OpenClaw
/install mexc-openapi-skill
Description
Operate MEXC Spot REST APIs through UXC with a curated OpenAPI schema, HMAC query signing, and separate public/signed workflow guardrails.
Usage Guidance
This skill appears to do what it says (wrap MEXC Spot REST via a curated OpenAPI schema and HMAC signing) but there are important inconsistencies you should resolve before use: 1) Confirm the installer/registry metadata lists the required environment variables (MEXC_API_KEY and MEXC_SECRET_KEY) so you know the skill will access secrets. 2) Verify 'uxc' (the execution/auth utility) is trusted in your environment — the skill delegates auth and signing to uxc. 3) Be aware the validate script requires jq and ripgrep (rg); ensure those tools are available. 4) Because the skill can perform signed writes (create/cancel orders), require explicit confirmations and limit the API key’s permissions and funds on the exchange (use a restricted API key where possible). 5) Inspect or pin the OpenAPI schema source (raw.githubusercontent.com URL) and consider hosting your own trusted copy if you need higher assurance. If the registry metadata cannot be corrected or you do not trust uxc or the schema source, treat this skill as higher risk and avoid giving it live API keys.
Capability Analysis
Type: OpenClaw Skill
Name: mexc-openapi-skill
Version: 1.0.0
The mexc-openapi-skill is a legitimate tool designed to interface with the MEXC Spot REST API using the uxc utility. It includes a standard OpenAPI schema (mexc-spot.openapi.json), clear authentication procedures using environment variables for HMAC signing, and explicit safety guardrails in SKILL.md that require confirmation for high-risk write operations. No indicators of data exfiltration, malicious execution, or prompt injection were found.
Capability Assessment
Purpose & Capability
The SKILL.md and OpenAPI schema clearly describe MEXC Spot public and signed flows (consistent with the name). However the skill metadata declares no required environment variables or binaries while the instructions explicitly require MEXC_API_KEY and MEXC_SECRET_KEY (via uxc auth) and the validate script requires jq and rg — this mismatch is incoherent and should be corrected.
Instruction Scope
Instructions stay within the stated purpose (link to API, curate OpenAPI schema, set up HMAC signer, prefer reads before writes, require confirmation for writes). But they instruct creating credentials from env:MEXC_API_KEY and env:MEXC_SECRET_KEY and adding a signer binding — yet those env vars are not declared in metadata. The skill also relies on an external 'uxc' skill and on network access to api.mexc.com and a raw.githubusercontent.com schema URL (expected but worth verifying trust).
Install Mechanism
This is instruction-only (no install spec), which is lowest install risk. Referenced schema is hosted on raw.githubusercontent.com (a normal release host). The included validate.sh is benign but requires jq and rg on PATH.
Credentials
The behavior legitimately requires two sensitive fields (API key and secret) for signed Spot operations, which is proportionate to the purpose — but those credentials are not listed in requires.env/primaryEnv. Also the validate script requires jq and rg which are not declared. The missing declarations reduce transparency about what secrets/tools the skill will use.
Persistence & Privilege
always:false and normal autonomous invocation settings. The skill does not request forced permanent inclusion or to modify other skills. Autonomous invocation combined with signed-write capability raises operational risk (it can place/cancel orders) but that risk follows from the feature, not from extra privileges requested by the skill.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install mexc-openapi-skill - After installation, invoke the skill by name or use
/mexc-openapi-skill - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of MEXC Spot API skill for UXC:
- Enables use of MEXC Spot REST APIs via UXC with curated OpenAPI schema.
- Supports public market reads, signed account reads, and signed order operations.
- Implements HMAC SHA256 signing and authentication guardrails for signed endpoints.
- Includes setup instructions for credential and signer binding.
- Provides groupings for public, signed read, and signed write operation types.
Metadata
Frequently Asked Questions
What is MEXC OpenAPI Skill?
Operate MEXC Spot REST APIs through UXC with a curated OpenAPI schema, HMAC query signing, and separate public/signed workflow guardrails. It is an AI Agent Skill for Claude Code / OpenClaw, with 268 downloads so far.
How do I install MEXC OpenAPI Skill?
Run "/install mexc-openapi-skill" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is MEXC OpenAPI Skill free?
Yes, MEXC OpenAPI Skill is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does MEXC OpenAPI Skill support?
MEXC OpenAPI Skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created MEXC OpenAPI Skill?
It is built and maintained by jolestar (@jolestar); the current version is v1.0.0.
More Skills