Alpha Finder (x402)

Market Oracle for prediction market intelligence - Polymarket and Kalshi research, probability assessments, market sentiment analysis, and arbitrage opportunity identification. Use when users want to research prediction markets, analyze betting odds, or find market inefficiencies. Costs $0.03 USDC per request via x402 protocol on Base network.

Security Scan

The skill asks users to provide a private key and then dynamically downloads and runs an unvetted npm package (via npx) but the registry metadata claims no credentials or install requirements — this mismatch and the runtime fetch of remote code are concerning.

Purpose & Capability

The description (market oracle, $0.03 per request via x402) implies on‑chain payments and therefore a private key is plausible — but the registry metadata lists no required env vars or credentials. The SKILL.md and the script both require an X402 private key and discuss Base/USDC payments; that credential requirement is missing from the declared metadata, which is an incoherence.

Instruction Scope

The SKILL.md instructs the user to place a raw private key in an env var or plaintext config file (~/.x402-config.json or other locations). The included script reads multiple filesystem locations (./, $HOME, $PWD) for the config and exports X402_PRIVATE_KEY into the environment before invoking remote code. The instructions therefore encourage storing and exposing a private key in widely accessible places and do not constrain or limit where the secret may flow.

Install Mechanism

There is no install spec, but the runtime script calls 'npx -y @itzannetos/x402-tools-claude ...', which will fetch and execute arbitrary code from the npm registry at runtime. That dynamic download/execute behavior is high risk and is not declared in the registry metadata. The script also depends on tools (npx/npm, jq) that are not declared as required binaries.

Credentials

The skill effectively requires a sensitive credential (X402 private key) and suggests storing it in plaintext in the home directory or passing it via env var; yet the registry metadata lists no required env variables. Passing a private key to unvetted remote code (via env) is disproportionate. Storing a private key in common locations (~/.x402-config.json, ./) increases risk of accidental exposure or exfiltration by other processes.

Persistence & Privilege

The skill does not request 'always: true' and does not declare persistent installation. However, it recommends writing a persistent config file (~/.x402-config.json) which creates long-lived secret material on disk. The remote npx invocation could also install packages into npm cache but the skill itself does not request system-wide persistence or modify other skill configs.

What to consider before installing

This skill is suspicious because it asks for a sensitive private key (not declared in registry metadata) and then uses npx to download and run a third‑party npm package at runtime. npx -y runs unvetted code which could exfiltrate any environment variables or files it has access to. Before using this skill: 1) Do not store your main wallet private key in plaintext; use an ephemeral/key with minimal funds and permissions if you must test. 2) Inspect the npm package @itzannetos/x402-tools-claude source (on npm/GitHub) and review what it does with X402_PRIVATE_KEY. 3) Require the skill owner to declare required env vars and binaries (jq, npx) in metadata and to provide a vetted install mechanism or vendored code instead of runtime npx. 4) Prefer running this script in an isolated environment (air‑gapped VM or container) if you must try it. 5) If you cannot verify the npm package and the author's identity, avoid providing any private key or wallet with real funds. Additional information that would change the assessment: an explicit, auditable install artifact (no runtime npx), published source code for @itzannetos/x402-tools-claude that you or a reviewer can inspect, or removal of the need to provide a private key.

Alpha Finder (Market Oracle)

Research prediction markets and find alpha using AI-powered market intelligence across Polymarket, Kalshi, and traditional sources.

Configuration

The private key must be available via one of these methods:

Option 1: Environment variable

export X402_PRIVATE_KEY="0x..."

Option 2: Config file (Recommended)

The script checks for x402-config.json in these locations (in order):

1. Current directory: ./x402-config.json
2. Home directory: ~/.x402-config.json ← Recommended
3. Working directory: $PWD/x402-config.json

Create the config file:

{
  "private_key": "0x1234567890abcdef..."
}

Example (home directory - works for any user):

echo '{"private_key": "0x..."}' > ~/.x402-config.json

Usage

Run the market research script with a query about prediction markets or events:

scripts/analyze.sh "<market query>"

The script:

• Executes market intelligence research with payment handling
• Costs $0.03 USDC per request (Base network)
• Searches web, GitHub, Reddit, and X for comprehensive analysis
• Returns AI-processed market insights and probability assessments

Examples

User: "What are the odds for Bitcoin hitting $100k?"

scripts/analyze.sh "Bitcoin 100k prediction market odds"

User: "Find arbitrage opportunities in election markets"

scripts/analyze.sh "2024 election prediction market arbitrage"

User: "Analyze Polymarket odds on AI developments"

scripts/analyze.sh "Polymarket AI development predictions"

User: "What's the market sentiment on climate policy outcomes?"

scripts/analyze.sh "climate policy prediction markets Kalshi Polymarket"

Capabilities

• Polymarket research - Event analysis and odds tracking
• Kalshi market analysis - Regulated prediction market insights
• Multi-source intelligence - Searches web, GitHub, Reddit, and X
• Probability assessments - AI-powered market sentiment analysis
• Arbitrage identification - Spot inefficiencies across markets
• Event research - Deep dive into specific prediction market events
• Historical tracking - Compare current odds to historical patterns

Data Sources

The tool automatically searches across:

• Polymarket events and odds
• Kalshi regulated markets
• Reddit discussions and sentiment
• X/Twitter market commentary
• GitHub repositories (for tech-related predictions)
• Web sources for news and analysis

Error Handling

• "Payment failed: Not enough USDC" → Inform user to top up Base wallet with USDC
• "X402 private key missing" → Guide user to configure private key (see Configuration above)
• Timeout errors → The API has a 5-minute timeout; comprehensive research may take time

Use Cases

• Trading: Find mispriced markets and arbitrage opportunities
• Research: Analyze market sentiment on specific events
• Due Diligence: Verify market probabilities before betting
• Portfolio Management: Track prediction market positions
• News Analysis: Understand how events impact market odds