ClawHub
Back to skill

Security audit

Football Data

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a legitimate football-data helper, but it asks agents to install unpinned remote Python code, which warrants Review before use.

Install only in a restricted virtual environment or container, prefer a pinned reviewed sports-skills release or commit, and avoid letting an agent automatically run the GitHub fallback without explicit approval. Expect some command confusion around get_head_to_head because the docs mark it both listed and unavailable.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:22
Finding

Unpinned Third-Party Package Installation from Mutable Sources

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22-26
Vulnerability Type: Unpinned dependency installation and mutable source-code retrieval
Risk Level: Medium

bash
which sports-skills || pip install sports-skills

If pip install fails (package not found or Python version error), install from GitHub:

bash
pip install git+https://github.com/machina-sports/sports-skills.git

The unpinned installation is also repeated in the troubleshooting instructions at SKILL.md:166.

Technical Analysis

The Skill instructs the Agent to install sports-skills from PyPI without specifying an audited version or integrity hash. If that installation fails, it retrieves and installs code directly from the external GitHub repository's mutable default revision rather than a reviewed commit SHA.

Python package installation can execute dependency-controlled build hooks and installation logic. Consequently, the code executed during future installations may differ from the code available when this Skill was audited. An upstream account compromise, malicious package update, dependency compromise, or unauthorized repository modification could therefore introduce arbitrary code into the installation process.

No malicious payload was identified in the files included in this project, and the GitHub organization is consistent with the declared Skill author. This finding represents an exploitable supply-chain weakness rather than evidence that the current upstream package is malicious.

Attack Path

  1. An attacker compromises the upstream PyPI project, GitHub repository, maintainer account, release process, or a transitive dependency.
  2. The attacker publishes malicious package content or modifies the GitHub repository's default revision.
  3. On first use, the Agent follows the setup instructions and executes the unpinned pip install command.
  4. pip downloads the attacker-controlled package version or ...[truncated 875 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin sports-skills to a reviewed, immutable version, such as sports-skills==X.Y.Z.
  2. Replace the GitHub default-branch installation with an immutable reviewed commit:
    bash
    pip install "git+https://github.com/machina-sports/sports-skills.git@FULL_COMMIT_SHA"
  3. Maintain a locked dependency file that pins all transitive dependencies.
  4. Require cryptographic hashes for packages, for example through a generated lock file and pip install --require-hashes.
  5. Build and verify dependencies in a controlled environment, then distribute an approved artifact rather than retrieving mutable code during normal Skill execution.
  6. Run installation and package execution in a restricted virtual environment or container with minimal filesystem permissions, no unnecessary credentials, and constrained outbound network access.
  7. Separate dependency installation from routine Skill use and require explicit operator approval before installing or upgrading external code.

SkillSpector

Vulnerability Patterns
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High
Category
YARA Match
Confidence
94% confidence
Finding

The skill instructs the agent/operator to install and execute code directly from a remote GitHub repository using pip install git+https://.... This is a supply-chain risk because the referenced repository can change over time, may be compromised, and is not pinned to a specific immutable commit or verified artifact; installing it grants arbitrary code execution during package build/install time.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

data: author: machina-sports version: "0.1.0"

Football Data

Before writing queries, consult references/api-reference.md for endpoints, ID conventions, and data shapes.

Setup

Before first use, check if the CLI is available:

bash
which sports-skills || pip install sports-skills

If pip install fails (package not found or Python version error), install from GitHub:

bash
pip install git+https://github.com/machina-sports/sports-skills.git

The package requires Python 3.10+. If your default Python is older, use a specific version:

bash
python3 --version  # check version
# If < 3.10, try: python3.12 -m pip install sports-skills
# On macOS with Homebrew: /opt/homebrew/bin/python3.12 -m pip install sports-skills

No API keys required.

Quick Start

Prefer the CLI — it avoids Python import path issues:

bash
sports-skills football get_daily_schedule
sports-skills football get_season_standings --season_id=premier-league-2025

Python SDK (alternati

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation contains contradictory guidance: it first lists get_head_to_head as a valid command, then later explicitly marks it as unavailable and says not to call it. In an agent skill, this inconsistency can mislead a model into selecting a nonfunctional or restricted command, causing tool misuse, failures, or attempts to access unlicensed functionality.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.