Query the PolyOx API for NBA data, Polymarket predictions, and AI matchup analysis. The analysis endpoint uses the x402 payment protocol (USDC on Base Sepolia).

Query the PolyOx API for NBA data, Polymarket predictions, and AI matchup analysis. The analysis endpoint uses the x402 payment protocol (USDC on Base Sepolia).

Security Scan

The skill's instructions require access to an EVM private key or installing a third-party agentic wallet to sign on-chain payments, but the skill metadata does not declare any required credentials — this mismatch and the instruction to install/run third-party CLIs is concerning and deserves caution.

Purpose & Capability

The skill name/description (PolyOx NBA data + Polymarket + x402 paid analysis) matches the SKILL.md instructions: free REST endpoints plus a paid analysis endpoint using x402 (USDC on Base Sepolia). Requiring wallet access to sign x402 payments is coherent with the stated purpose. However, the skill metadata declares no required environment variables or primary credential while the runtime instructions explicitly ask the user/agent to set EVM_PRIVATE_KEY or install a wallet — this metadata/instruction mismatch is notable.

Instruction Scope

SKILL.md instructs the agent/user to: (a) set an EVM_PRIVATE_KEY env var (private key access), (b) install and use a third-party Coinbase Agentic Wallet CLI via npx (which itself requests email/OTP), and (c) perform EIP-712 signing and send signatures in request headers. These steps require access to secrets and to install/execute third-party tooling; the document also gives concrete shell commands (curl, base64, jq). The instructions therefore reach beyond simple read-only API queries into signing transactions and private-key handling — which is high-sensitivity behavior and should have been declared in metadata.

Install Mechanism

The skill itself has no install spec and is instruction-only (lower static install risk), but it explicitly tells the agent/user to run npx to add the coinbase/agentic-wallet-skills and to use npx awal@latest commands. Prompting installation of third-party npm packages at runtime is a moderate risk (pulling and executing external code). There is no pinned/verified package version in the SKILL.md excerpt and no attestations about the third-party package's provenance.

Credentials

The paid x402 flow legitimately requires signing with an EVM private key or using a wallet; requesting EVM_PRIVATE_KEY is proportionate to performing the payment. But the skill metadata lists no required environment variables while the instructions explicitly reference EVM_PRIVATE_KEY and wallet installation. That mismatch can cause an agent to read secrets that weren't declared as required. Also the guidance to authenticate via email with a third-party wallet CLI (npx) introduces additional secret exchange/credential flows that are not described in the metadata.

Persistence & Privilege

The skill does not request 'always: true' and offers no install spec or files to persist into the agent. Autonomous invocation is allowed (platform default) but not by itself a red flag here. The skill does instruct installing an external wallet CLI, but that is an action outside the skill's bundle, not a built-in persistence request by the skill itself.

What to consider before installing

What to consider before installing/using this skill: - The skill's runtime instructions require signing payments with an EVM private key or installing a third-party wallet CLI, but the skill metadata does not declare any required credentials — treat that mismatch as a warning sign. Do not set your mainnet private key (EVM_PRIVATE_KEY) in an environment accessible to shared agents or services. - Prefer using a throwaway/testnet wallet (Base Sepolia) and fund it with small test USDC amounts before any real use. Never use production/mainnet funds unless you fully trust the code and endpoints. - If you must use the Coinbase Agentic Wallet CLI: verify the package name, author, version, and source repository before running npx; consider auditing that package separately. Using npx runs remote code on your machine — confirm the package integrity and pin versions. - Review and trust the API host (https://api-hoobs.polyox.io) before sending requests that trigger payments. Confirm domain ownership / docs and check for HTTPS/TLS validity. - Because the SKILL.md instructs the agent to access/handle private keys and install tooling, you should either: (a) refuse to provide secrets and use only the skill's free, read-only endpoints; or (b) perform an independent security review of the third-party wallet tooling and the PolyOx API before handing over any private key or running any installation commands. - If you want to change the risk profile: request the maintainer add explicit metadata (required.env includes EVM_PRIVATE_KEY or a clear note that no env var is required and only agentic wallet will be used), and provide a reproducible, auditable wallet integration path (e.g., signed releases, pinned package versions).

PolyOx NBA API

Base URL: https://api-hoobs.polyox.io

All responses are JSON. Paginated endpoints return { data, page, pageSize, total }.

---

Step 0 — Check your wallet

Before calling any paid endpoint you need an EVM wallet with USDC on Base Sepolia.

Already have a wallet? Make sure the EVM_PRIVATE_KEY environment variable is set and skip to Quick start.

Don't have a wallet? Set one up with Coinbase Agentic Wallet — a CLI wallet built for AI agents. No private key management required.

Set up Coinbase Agentic Wallet

Prerequisites: Node.js 24+ and an email address.

# Install the agentic-wallet skills (one-time)
npx skills add coinbase/agentic-wallet-skills

Authenticate

# 1. Start login — sends a 6-digit code to your email
npx awal@latest auth login [e-mail]

# 2. Verify with the code you received
npx awal@latest auth verify <flowId> <otp>

# 3. Confirm authentication
npx awal@latest status

Check address & balance

npx awal@latest address
npx awal@latest balance

Fund your wallet

Get testnet USDC from the Base Sepolia faucet, or ask another agent / user to send USDC to your wallet address.

Full Agentic Wallet docs: https://docs.cdp.coinbase.com/agentic-wallet/quickstart

---

Quick start

# Today's games
curl "https://api-hoobs.polyox.io/nba/games?date=2026-02-08"

# Matchup context (injuries, recent form, Polymarket odds)
curl "https://api-hoobs.polyox.io/nba/games/context?date=2026-02-08&home=MIN&away=LAC"

# Latest injury report
curl "https://api-hoobs.polyox.io/nba/injury-reports/latest"

---

Free endpoints

NBA

Method	Path	Description
GET	/nba/teams	List all teams
GET	/nba/teams/{id}	Get one team
GET	/nba/games	List games (filter: date, from, to, status, season, teamId)
GET	/nba/games/{id}	Get one game
GET	/nba/games/{id}/markets	Polymarket markets for a game
GET	/nba/games/context	Full matchup context — requires date, home, away
GET	/nba/players	List players (filter: search, isActive, teamId)
GET	/nba/players/{id}	Get one player
GET	/nba/team-stats	Team game stats (filter: gameId, teamId)
GET	/nba/player-stats	Player game stats (filter: gameId, playerId, teamId)
GET	/nba/injury-reports	List injury reports
GET	/nba/injury-reports/latest	Latest entries (filter: team, status, date)

Polymarket

Method	Path	Description
GET	/polymarket/events	List events (filter: date, search)
GET	/polymarket/markets	List markets (filter: eventId, search)
GET	/polymarket/price	Live CLOB prices (tokenId or marketIds)
GET	/polymarket/orderbook	Live CLOB orderbook (tokenId or marketIds)

All list endpoints support page and pageSize query params.

---

Paid endpoint — x402 protocol

POST /nba/analysis

AI-powered matchup analysis. Payment via x402 — the HTTP-native payment standard.

• Network: Base Sepolia (chain ID 84532)
• Token: USDC at 0x036CbD53842c5426634e7929541eC2318f3dCF7e
• Protocol docs: https://docs.x402.org

Request body

{
  "date": "2026-02-08",
  "home": "MIN",
  "away": "LAC"
}

All three fields required. date is YYYY-MM-DD, home/away are team abbreviations.

---

How x402 works (step by step)

Step 1 — Send the request

Make a normal HTTP request. The server will respond with HTTP 402.

curl -s -D - -X POST \
  -H "Content-Type: application/json" \
  -d '{"date":"2026-02-08","home":"MIN","away":"LAC"}' \
  "https://api-hoobs.polyox.io/nba/analysis"

Step 2 — Parse the 402 response

The 402 response includes a PAYMENT-REQUIRED header. Decode it from base64 to get the payment requirements:

# Extract and decode the payment requirements
PAYMENT_REQUIRED=$(curl -s -D - -X POST \
  -H "Content-Type: application/json" \
  -d '{"date":"2026-02-08","home":"MIN","away":"LAC"}' \
  "https://api-hoobs.polyox.io/nba/analysis" \
  | grep -i "payment-required" | cut -d' ' -f2 | tr -d '\r')

echo "$PAYMENT_REQUIRED" | base64 -d | jq .

The decoded JSON contains:

{
  "maxAmountRequired": "...",
  "resource": "...",
  "payTo": "0x...",
  "asset": "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
  "network": "eip155:84532",
  "expiresAt": "...",
  "nonce": "...",
  "paymentId": "...",
  "accepts": [{ "scheme": "exact", "network": "eip155:84532" }]
}

Step 3 — Sign and construct the payment

Using the payment requirements, create an EIP-712 typed-data signature that authorises the USDC transfer. This is an off-chain signature — no gas spent.

The signature must be sent as a base64-encoded JSON payload in the PAYMENT-SIGNATURE header when retrying the request.

Important: The EIP-712 signing step requires a crypto library. Pure curl cannot sign. Use one of the approaches below.

Step 4 — Retry with payment

curl -X POST \
  -H "Content-Type: application/json" \
  -H "PAYMENT-SIGNATURE: <base64_encoded_signed_payload>" \
  -d '{"date":"2026-02-08","home":"MIN","away":"LAC"}' \
  "https://api-hoobs.polyox.io/nba/analysis"

The server verifies the signature, settles the payment on-chain, and returns the analysis. A PAYMENT-RESPONSE header is included with settlement proof.

---

Agent integration options

Choose the approach that matches your setup:

Option A — Coinbase Agentic Wallet (recommended)

The simplest path. If you set up your wallet via awal in Step 0, you can pay for x402 endpoints in a single command — no code, no private key handling.

# Pay and call the analysis endpoint
npx awal@latest x402 pay \
  "https://api-hoobs.polyox.io/nba/analysis" \
  -X POST \
  -d '{"date":"2026-02-08","home":"MIN","away":"LAC"}'

The awal x402 pay command handles the full 402 → sign → retry flow automatically. Options:

Flag	Description
-X, --method <method>	HTTP method (default: GET)
-d, --data <json>	JSON request body
-q, --query <params>	Query parameters
--max-amount <amount>	Max USDC to spend (in micro-units)
--json	Output raw JSON

Agentic Wallet skills reference: https://docs.cdp.coinbase.com/agentic-wallet/skills/overview

Option B — Node.js / TypeScript

If you already have an EVM private key and prefer programmatic control:

npm install @x402/fetch @x402/core @x402/evm viem

import { wrapFetchWithPayment } from "@x402/fetch";
import { x402Client } from "@x402/core/client";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const signer = privateKeyToAccount(process.env.EVM_PRIVATE_KEY as `0x${string}`);
const client = new x402Client();
registerExactEvmScheme(client, { signer });

const fetchWithPayment = wrapFetchWithPayment(fetch, client);

const res = await fetchWithPayment(
  "https://api-hoobs.polyox.io/nba/analysis",
  {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ date: "2026-02-08", home: "MIN", away: "LAC" }),
  },
);

console.log(await res.json());

Note for AI agents: Option A is the fastest way to get started — no private key required. Option B gives full programmatic control if you already manage your own wallet.

---

Reference

Team abbreviations: ATL, BOS, BKN, CHA, CHI, CLE, DAL, DEN, DET, GSW, HOU, IND, LAC, LAL, MEM, MIA, MIL, MIN, NOP, NYK, OKC, ORL, PHI, PHX, POR, SAC, SAS, TOR, UTA, WAS

Date format: YYYY-MM-DD

Pagination: page (1-indexed), pageSize (default 50)