Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Numinous Tools

v1.0.1

Access Numinous (Bittensor Subnet 6) forecasting tools — AI probability predictions on binary events, real-time signals aggregated from news and prediction m...

0· 43·0 current·0 all-time
Security Scan
Capability signals
CryptoRequires walletCan make purchasesRequires OAuth tokenRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill name/description (Numinous forecasting & signals) aligns with the scripts and endpoints in SKILL.md and the shipped Python code. However the registry metadata lists no required environment variables or primary credential, while SKILL.md and the scripts clearly require NUMINOUS_API_KEY and/or raw private keys (NUMINOUS_X402_EVM_PRIVATE_KEY / NUMINOUS_X402_SVM_PRIVATE_KEY). This metadata omission is an incoherence — the declared requirements do not reflect what the skill actually needs.
Instruction Scope
SKILL.md and the three Python scripts limit their actions to calling the documented Numinous endpoints, polling jobs, and rendering results. They instruct the user how to set env vars and explicitly warn not to commit keys. The scripts print full response JSON (including prediction IDs and miner reasoning), which could reveal sensitive or private IDs if shared. No instructions ask the agent to read arbitrary host files or send data to unexpected external endpoints beyond the declared Numinous base URLs.
Install Mechanism
There is no install spec (instruction-only), which is low risk, but forecast_x402.py depends on third-party packages (x402[client], eth-account, httpx) and the code exits with an ImportError message instructing pip install. The registry does not declare these dependencies or provide an install step — a metadata omission that can cause runtime failures or surprise when installing dependencies manually. There are no downloads from untrusted URLs or archive extraction.
!
Credentials
The scripts require sensitive secrets: NUMINOUS_API_KEY (reasonable and expected) and optionally raw private keys (NUMINOUS_X402_EVM_PRIVATE_KEY / NUMINOUS_X402_SVM_PRIVATE_KEY) for automated crypto payments. Requesting raw private keys is security-sensitive and more intrusive than a single service API key. The registry omitted these env vars and did not mark an API key as the primary credential, creating a mismatch between what is requested and what is declared.
Persistence & Privilege
The skill is user-invocable, not always-enabled, does not request persistent system-wide privileges, and does not modify other skills or agent configuration. Autonomous invocation is allowed by platform default (not an extra privilege here).
What to consider before installing
This skill appears to be what it claims (forecasting and signals) but the package metadata is incomplete and the code asks for sensitive secrets. Before installing or running it: (1) Do not paste private keys into a web form or share them — if you must automate payments, prefer wallets that can sign without exposing raw keys (hardware wallet, remote signer) or use the API key route. (2) Prefer providing a NUMINOUS_API_KEY (safer) rather than exporting raw EVM/Solana private keys into your environment. (3) Be aware the scripts print full response JSON (including prediction IDs and reasoning); treat that output as possibly sensitive and avoid sharing. (4) The skill has unstated Python dependencies (x402, eth-account, httpx); run it in an isolated virtualenv and inspect the third-party packages first. (5) Ask the publisher to correct registry metadata to list required env vars and a primary credential and to document dependency installation. If you don't trust the source or cannot avoid supplying a private key, do not install/run this skill.

Like a lobster shell, security has layers — review code before you run it.

latestvk977meayv0bja3dfdkq6wz05h5850eza
43downloads
0stars
2versions
Updated 4d ago
v1.0.1
MIT-0

Numinous Forecasting Tools

Numinous is a decentralized forecasting network (Bittensor Subnet 6). Miners submit Python forecasting agents; validators score them; this plugin wraps the public APIs the network exposes.

API surfaces

Base URLWhat lives hereDocs Swagger
https://api.numinouslabs.ioForecasts, leaderboard, miner agents, historical runs/api/docs
https://signals.numinouslabs.ioSignals (news + market aggregation, LLM-scored)/docs
https://api-eversight.numinouslabs.ioBalance, usage, costs (public), Stripe top-ups (browser only)/docs

Credits are shared across all three — spend on forecasts or signals draws from the same balance.

First-run setup

Scripts live at ./scripts/ relative to this SKILL.md. The scripts work regardless of cwd, but paths in this doc assume you run them from the skill directory. Before running anything, check whether these env vars are set: NUMINOUS_API_KEY, NUMINOUS_X402_EVM_PRIVATE_KEY, NUMINOUS_X402_SVM_PRIVATE_KEY.

Then pick an auth path based on what the user wants:

User wantsNeedsEnv var
Forecasts + signals, pay in USD via top-upAPI keyNUMINOUS_API_KEY
Forecasts only, pay in crypto per requestFunded EVM wallet (USDC on Base)NUMINOUS_X402_EVM_PRIVATE_KEY
Forecasts only, pay in crypto per requestFunded Solana wallet (USDC on Solana)NUMINOUS_X402_SVM_PRIVATE_KEY

If neither is set, walk the user through the decision:

You can use Numinous two ways:

  1. API key (recommended) — works for everything (forecasts + signals), prepaid credit balance. Create one at https://eversight.numinouslabs.io/api-keys (up to 5 per account) and top up at https://eversight.numinouslabs.io/payments. Set NUMINOUS_API_KEY=<your_key>.
  2. x402 crypto payment — forecasts only (signals doesn't accept x402). No account needed, just a funded USDC wallet on Base or Solana. Set NUMINOUS_X402_EVM_PRIVATE_KEY=<hex> or NUMINOUS_X402_SVM_PRIVATE_KEY=<base58>.

Which would you like to set up?

Env vars should live in the user's shell environment (bash/zsh profile on macOS/Linux, PowerShell profile or System Properties on Windows) or a project-local .env file that's gitignored. Use whatever idiom matches the user's shell — e.g. export NUMINOUS_API_KEY=... for bash/zsh, $env:NUMINOUS_API_KEY = "..." for PowerShell, setx NUMINOUS_API_KEY "..." for Windows cmd. Never write keys to repo-committed files.

Capabilities & costs

Fetch current pricing at runtime — don't hardcode. The endpoint is public, no auth:

GET https://api-eversight.numinouslabs.io/api/v1/credits/costs

At time of writing:

CapabilityScript / endpointCostAuth
Create a forecast (async job)scripts/forecast.py0.1 creditsAPI key
Create a forecast paying via cryptoscripts/forecast_x402.py$0.10 USDCx402 wallet
Get signals for a market/questionscripts/signals.py0.025 creditsAPI key (no x402)
Check balanceGET /api/v1/me/balancefreeAPI key
Check usage historyGET /api/v1/me/usagefreeAPI key
Get current costsGET /api/v1/credits/costsfreenone
Browse miner leaderboardGET /api/v1/leaderboardfreenone
Read a miner's agent codeGET /api/v1/agents/{version_id}/codefreenone
Top up balance (Stripe)web UI onlybrowser session

Runbooks

Get a forecast (most common path)

Two input modes. Structured is more precise; query is faster to compose.

Shell-quoting gotcha: if the question contains a $ sign, always use single quotes (bash/zsh/PowerShell all treat single quotes as literal). Double quotes will shell-expand $150k to 50k, silently asking a different question. When in doubt — or anytime a dollar amount is involved — prefer structured mode, which takes each field as a separate --title / --description flag with no substring ambiguity.

Query mode — one natural-language line:

python ./scripts/forecast.py 'Will Bitcoin exceed $150k before end of 2026?'

Structured mode — explicit event spec (safest when prices / $ are involved):

python ./scripts/forecast.py \
  --title 'Will Bitcoin exceed $150,000 before end of 2026?' \
  --description 'Resolves YES if BTC spot price on any major exchange reaches $150,000 USD at any point before 2026-12-31T23:59:59Z.' \
  --cutoff 2026-12-31T23:59:59Z \
  --topics crypto,finance

Pin a specific miner (any mode) with --agent-version-id <uuid>. Get version IDs from the leaderboard (see below). When unpinned, the network auto-routes to the top pool miner.

The script submits, polls every 5s, and prints the final probability plus the miner's reasoning. Typical completion: 25–120 seconds.

Pay for a forecast via crypto (x402)

Same args as the API-key forecast. Uses NUMINOUS_X402_EVM_PRIVATE_KEY (preferred) or NUMINOUS_X402_SVM_PRIVATE_KEY. Wallet must hold enough USDC ($0.10 per request).

python ./scripts/forecast_x402.py 'Will ETH exceed $10k before end of 2026?'

The x402 Python library auto-handles the 402 → sign → retry flow. No signals support — if the user asks to pay for signals via crypto, tell them it's not available and offer the API key route.

Get signals for a prediction market

Accepts a Polymarket URL, slug, condition_id, or a free-text question.

# Polymarket (URL or slug; compound event URLs and sub-market slugs both work)
python ./scripts/signals.py --market https://polymarket.com/event/some-slug

# Free-text question — use single quotes if the question contains $
python ./scripts/signals.py --question 'Will Iran conduct a nuclear test before end of 2026?'

Returns ranked signals from exa (web news), Indicia (geopolitics, Polymarket markets, LiveUAMap, GDELT, unusual_whales), and Perplexity — each scored by Grok with relevance_score (0-1), impact_score (0-1), impact_bucket (S1-S3 scenario ladder), direction (supports_yes / supports_no / neutral), and a one-sentence rationale.

Check balance and usage

No script needed — simple GET requests. Use whichever HTTP tool matches the user's environment (curl on Unix/Git Bash, Invoke-RestMethod on PowerShell, Python urllib.request, or your agent's WebFetch equivalent).

  • Balance: GET https://api-eversight.numinouslabs.io/api/v1/me/balance with header X-API-Key: <NUMINOUS_API_KEY>
  • Usage: GET https://api-eversight.numinouslabs.io/api/v1/me/usage?limit=50 (also accepts since=<ISO8601>, limit up to 200) with the same header

Bash example:

curl -s -H "X-API-Key: $NUMINOUS_API_KEY" https://api-eversight.numinouslabs.io/api/v1/me/balance

PowerShell example:

Invoke-RestMethod -Uri https://api-eversight.numinouslabs.io/api/v1/me/balance -Headers @{ "X-API-Key" = $env:NUMINOUS_API_KEY }

/me/usage transactions include a resource field — values are signal_compute or prediction_job. Use this to group spend by product (not the description string).

When the user wants to top up, send them to https://eversight.numinouslabs.io/payments (Stripe, browser-only).

Browse the leaderboard / inspect a miner

All public, no auth needed. Again, use any HTTP tool — examples shown in bash:

# Top miners (sorted by the active pool — currently global_brier by default)
curl -s "https://api.numinouslabs.io/api/v1/leaderboard?limit=10"

# A specific miner's agent versions
curl -s "https://api.numinouslabs.io/api/v1/miners/{miner_uid}/{miner_hotkey}/agents"

# Read the actual forecasting code a miner is running
curl -s "https://api.numinouslabs.io/api/v1/agents/{version_id}/code"

When the user wants to "pin" a miner in a forecast, grab a version_id from /agents and pass --agent-version-id to forecast.py.

Troubleshooting

SymptomCauseFix
402 Payment Required, body {}, payment-required header setNo auth on a paid endpointSet NUMINOUS_API_KEY or use the _x402 script
401 on /me/*X-API-Key missing or invalidRe-check the env var, or rotate the key at /api-keys
404 MARKET_NOT_FOUND on signalsPolymarket slug stale / closedAsk user for a current URL, or try a sub-market slug from their multi-market event
422 VALIDATION_ERROR on signalsSent both market and question, or neitherSend exactly one
502 UPSTREAM_UNAVAILABLE on signalsPolymarket Gamma downTransient, retry; or fall back to free-text --question
Forecast stuck PENDING > 3 minMiner queue slowKeep polling up to 5 min; occasionally miners retry
Can't reach api.numinouslabs.io/docs from an agentBot-blocked swagger UIRead reference.md in this skill instead, or fetch https://api.numinouslabs.io/api/openapi.json (public)

Links for the user

Deeper reference

See reference.md for full endpoint schemas, response field definitions, forecaster names, x402 payment header format, and the impact_bucket ladder. Load it only when you need details the tables above don't cover.

Comments

Loading comments...