Query the PolyOx API for NBA data, Polymarket predictions, and AI matchup analysis. The analysis endpoint uses the x402 payment protocol (USDC on Base Sepolia).

Query the PolyOx API for NBA data, Polymarket predictions, and AI matchup analysis. The analysis endpoint uses the x402 payment protocol (USDC on Base Sepolia).

What to consider before installing/using this skill: - The skill's runtime instructions require signing payments with an EVM private key or installing a third-party wallet CLI, but the skill metadata does not declare any required credentials — treat that mismatch as a warning sign. Do not set your mainnet private key (EVM_PRIVATE_KEY) in an environment accessible to shared agents or services. - Prefer using a throwaway/testnet wallet (Base Sepolia) and fund it with small test USDC amounts before any real use. Never use production/mainnet funds unless you fully trust the code and endpoints. - If you must use the Coinbase Agentic Wallet CLI: verify the package name, author, version, and source repository before running npx; consider auditing that package separately. Using npx runs remote code on your machine — confirm the package integrity and pin versions. - Review and trust the API host (https://api-hoobs.polyox.io) before sending requests that trigger payments. Confirm domain ownership / docs and check for HTTPS/TLS validity. - Because the SKILL.md instructs the agent to access/handle private keys and install tooling, you should either: (a) refuse to provide secrets and use only the skill's free, read-only endpoints; or (b) perform an independent security review of the third-party wallet tooling and the PolyOx API before handing over any private key or running any installation commands. - If you want to change the risk profile: request the maintainer add explicit metadata (required.env includes EVM_PRIVATE_KEY or a clear note that no env var is required and only agentic wallet will be used), and provide a reproducible, auditable wallet integration path (e.g., signed releases, pinned package versions).

Type: OpenClaw Skill Name: polyox-nba Version: 0.2.0 The skill is classified as suspicious due to its reliance on executing external tools via `npx` and shell commands (`curl`, `grep`, `cut`, `tr`, `base64 -d`, `jq`, `npm install`) as direct instructions to the AI agent within `skill.md`. While these commands are presented for legitimate purposes (setting up a Coinbase Agentic Wallet, interacting with the x402 payment protocol, installing Node.js dependencies), they represent a significant attack surface. The skill also instructs the agent to access environment variables like `EVM_PRIVATE_KEY` for cryptographic operations. These capabilities, if exploited through prompt injection or other vulnerabilities in the agent's execution environment, could lead to remote code execution, unauthorized cryptocurrency transactions, or data exfiltration, even though the provided content does not show explicit malicious intent.