MEXC OpenAPI Skill

Operate MEXC Spot REST APIs through UXC with a curated OpenAPI schema, HMAC query signing, and separate public/signed workflow guardrails.

This skill appears to do what it says (wrap MEXC Spot REST via a curated OpenAPI schema and HMAC signing) but there are important inconsistencies you should resolve before use: 1) Confirm the installer/registry metadata lists the required environment variables (MEXC_API_KEY and MEXC_SECRET_KEY) so you know the skill will access secrets. 2) Verify 'uxc' (the execution/auth utility) is trusted in your environment — the skill delegates auth and signing to uxc. 3) Be aware the validate script requires jq and ripgrep (rg); ensure those tools are available. 4) Because the skill can perform signed writes (create/cancel orders), require explicit confirmations and limit the API key’s permissions and funds on the exchange (use a restricted API key where possible). 5) Inspect or pin the OpenAPI schema source (raw.githubusercontent.com URL) and consider hosting your own trusted copy if you need higher assurance. If the registry metadata cannot be corrected or you do not trust uxc or the schema source, treat this skill as higher risk and avoid giving it live API keys.

Type: OpenClaw Skill Name: mexc-openapi-skill Version: 1.0.0 The mexc-openapi-skill is a legitimate tool designed to interface with the MEXC Spot REST API using the uxc utility. It includes a standard OpenAPI schema (mexc-spot.openapi.json), clear authentication procedures using environment variables for HMAC signing, and explicit safety guardrails in SKILL.md that require confirmation for high-risk write operations. No indicators of data exfiltration, malicious execution, or prompt injection were found.