Query the PolyOx API for NBA data, Polymarket predictions, and AI matchup analysis. The analysis endpoint uses the x402 payment protocol (USDC on Base Sepolia).

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:14 AM UTC
• Version: 0.2.0

Overview

The skill is coherent, but it needs Review because it combines wallet payments with unpinned command execution and weak safeguards for spending and private keys.

Review this skill carefully before installing. Use only testnet or low-value wallets, avoid exposing raw private keys to broad agent environments, pin and verify wallet tooling before running npx commands, and require explicit checks of amount, recipient, token, network, and a maximum spend before any x402 payment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: skill.md:35

Finding

Execution of Unpinned Third-Party Packages Through npx

Content

View full analysis

# 3. Confirm authentication npx awal@latest status ``` The payment workflow later executes the same mutable package reference: ```bash # Pay and call the analysis endpoint npx awal@latest x402 pay \ "https://api-hoobs.polyox.io/nba/analysis" \ -X POST \ -d '{"date":"2026-02-08","home":"MIN","away":"LAC"}' ``` ### Technical Analysis The documented workflow uses `npx` to retrieve and execute third-party packages at runtime. In particular, `awal@latest` refers to a mutable registry tag rather than a specific reviewed version. The `coinbase/agentic-wallet-skills` installation instruction also does not specify a version, commit, or integrity value. Consequently, the code executed when a user follows these instructions can differ from the code available when the skill was audited. A compromised package publisher, registry account, dependency, or mutable release could introduce arbitrary executable code. Because these commands are involved in authentication and wallet payment operations, the execution context may contain sensitive wallet state, authentication data, environment variables, and access to user files. ### Attack Path 1. An attacker compromises the package publisher, registry account, upstream repository, or a transitive dependency. 2. The attacker publishes a malicious release and assigns it to the `latest` tag, or otherwise modifies the unpinned dependency source. 3. A user or agent follows the skill ins ...[truncated 966 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.md:211

Finding

Recommended x402 Payment Command Omits a Mandatory Spending Limit

Content

View full analysis

` | HTTP method (default: GET) | | `-d, --data ` | JSON request body | | `-q, --query ` | Query parameters | | `--max-amount ` | Max USDC to spend (in micro-units) | | `--json` | Output raw JSON | ``` ### Technical Analysis The x402 workflow obtains payment requirements from an HTTP 402 response and then signs and retries the request. Those server-provided requirements contain security-sensitive values such as the payment amount, recipient, asset, network, resource, expiry, and nonce. The recommended command does not supply the available `--max-amount` control, and the skill does not state a fixed expected price or require the user to verify the decoded payment requirements before authorization. This weakens transaction-intent validation by allowing a remote service to determine the requested payment without a skill-level upper bound. The finding does not establish that the wallet client ignores all internal safeguards or confirmations. However, relying solely on unspecified client behavior leaves the documented workflow exposed to excessive payment requests if the API, its domain, or its payment configuration is compromised or misconfigured. ### Attack Path 1. The PolyOx API, ...[truncated 1227 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill tells users to set EVM_PRIVATE_KEY but does not include any warning about secret handling, storage, redaction, or the risks of exposing raw private keys to agent environments. In an agent skill, this can normalize unsafe secret practices and increase the likelihood of credential leakage or misuse.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run npx skills add coinbase/agentic-wallet-skills without pinning an immutable version. This lets whatever package is currently published under that name execute on the user's machine at install time, creating a supply-chain execution risk that is especially dangerous in a wallet-related setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The command npx awal@latest auth login executes the latest published package version, which can change over time and may run arbitrary code. Because this tool is used for wallet authentication, compromise could expose session state, wallet metadata, or lead to further malicious actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The unpinned npx awal@latest auth verify command creates the same supply-chain risk as other @latest uses, with the added sensitivity of handling authentication flows. An attacker controlling or compromising the package distribution channel could execute arbitrary code during a security-sensitive step.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

Running npx awal@latest status still permits arbitrary code execution from an unpinned remote package, even if the command appears read-only. In the context of agent wallet setup, that broadens attack surface unnecessarily and undermines reproducibility and trust.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The npx awal@latest address instruction invokes an unpinned package from the registry, exposing users to arbitrary code execution and possible wallet data exfiltration. Even though the command is informational, it is in a financial-tooling context and should be treated as sensitive.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The npx awal@latest balance command is another unpinned package execution path. In a wallet context, a compromised package could collect identifiers, probe local environment secrets, or pivot to broader host compromise.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 149)May include surrounding context.

Make a normal HTTP request. The server will respond with HTTP 402.

bash

curl -s -D - -X POST \
  -H "Content-Type: application/json" \
  -d '{"date":"2026-02-08","home":"MIN","away":"LAC"}' \
  "https://api-hoobs.polyox.io/nba/analysis"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

This retry request sends a PAYMENT-SIGNATURE header to an external service, which is a security-sensitive authorization artifact tied to a payment flow. While expected for x402, the skill provides no explicit safeguards around validating the 402 challenge, limiting spend, or warning users that they are authorizing value transfer, making misuse or spoofed-payment scenarios more dangerous.

Content

Scanner excerpt · skill.md (reported line 200)May include surrounding context.

Step 4 — Retry with payment

bash

curl -X POST \
  -H "Content-Type: application/json" \
  -H "PAYMENT-SIGNATURE: <base64_encoded_signed_payload>" \
  -d '{"date":"2026-02-08","home":"MIN","away":"LAC"}' \

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The recommended payment flow uses npx awal@latest x402 pay, an unpinned executable performing a payment-related action. This is particularly risky because arbitrary code execution here could manipulate payment requests, exfiltrate secrets, or authorize unintended financial operations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.