Security audit

Numinous Forecast

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated forecasting purpose, but it can automatically sign crypto payments from a wallet without local spending or recipient limits.

Install only with a dedicated low-balance wallet key, not a main wallet. Review or add local payment limits for amount, recipient, network, and asset before use, and pin dependencies if possible. Avoid sending confidential forecasting questions because the inputs are submitted to the Numinous remote API.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: numinous_api.py:272
Finding: Server-Controlled Cryptocurrency Payments Lack Local Spending and Recipient Restrictions
Content: View full analysis
Remediation: View remediation
`, rather than accepting every EVM or Solana network. - Require the asset contract or identifier to match a locally approved asset. - Validate token decimals before interpreting amounts. 4. **Require explicit approval** - Display the amount, asset, network, and recipient and require confirmation before signing. - For noninteractive use, permit automatic payment only when every term matches a preconfigured policy. 5. **Add cumulative limits** - Track per-process or persistent daily expenditure. - Refuse additional authorizations after the configured budget is reached. 6. **Reject ambiguity** - Require exactly one policy-compliant payment option. - Reject duplicate, incomplete, or conflicting options rather than relying on library selection behavior. 7. **Test hostile responses** - Add tests for excessive amounts, unknown recipients, unsupported assets, wrong chain IDs, malformed values, and multiple ambiguous offers. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:21
Finding: Wallet-Sensitive Third-Party Dependencies Are Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill explicitly requires access to environment variables containing private payment keys and makes paid network calls, but it does not declare any tool scope or allowed-tools restrictions. That omission weakens least-privilege controls: an agent runtime may grant broader capabilities than necessary, increasing the chance that secrets are exposed to unintended code paths or that network access is used in unexpected ways.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file accesses EVM and SVM private keys from environment variables and later uses them to sign payment requests. Although the behavior is functional and expected for payment handling, this file provides no visible warning, logging, or explanatory notice to the user that wallet credentials are required and will be used for signing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code sends user-supplied prediction content such as query, title, description, cutoff, and topics to an external API via HTTP POST, and also performs an x402 payment flow. While the code handles errors, it does not include any confirmation prompt, print/log disclosure, or comment/docstring warning that user data will be transmitted to a third-party service and may trigger payment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This CLI forwards the user's natural-language query and selected topics to a remote prediction service via predict_job without any disclosure in this file that the input leaves the local environment. While this appears to be the intended function of the skill rather than malicious behavior, undisclosed transmission can expose sensitive user-entered content to a third-party service and create privacy/compliance issues.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.