ClawHub

Cricket Live Score

v1.1.1

Send live cricket score updates (text + voice memo) to Telegram for any ongoing T20 or ODI match. Completely free.

⭐ 0· 267·0 current·0 all-time
by@arkulkarni
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description claim sending live cricket updates to Telegram; the code scrapes cricbuzz.com, formats text, optionally generates voice memos with gTTS, and posts to the Telegram Bot API. The token/config reads and network calls (Cricbuzz + api.telegram.org) are expected for this functionality.
✓
Instruction Scope
SKILL.md instructs running the included Python script with a Cricbuzz URL, chat ID, and optional bot token. The script only reads the specified Cricbuzz page and (optionally) a Telegram bot token from an env var or the OpenClaw config path (~/.openclaw/openclaw.json) — all are declared in the docs. There are no instructions to read unrelated system files or to exfiltrate data to unexpected endpoints.
✓
Install Mechanism
This is instruction-only (no install spec), which is low risk. The code requires the gTTS package for voice memos; that dependency is documented in SKILL.md but not automatically installed by the registry — the user must install it in their environment.
✓
Credentials
The only sensitive input used is a Telegram bot token (via --bot-token, TELEGRAM_BOT_TOKEN env var, or OpenClaw config), which is necessary to post messages. The script optionally honors OPENCLAW_CONFIG to locate the OpenClaw config file; no other credentials or unrelated env vars are accessed.
✓
Persistence & Privilege
The skill is not 'always' enabled and is user-invocable. It does not request permanent platform presence or modify other skills or system-wide settings.
Assessment
This skill appears to do what it says: scrape Cricbuzz and send updates to Telegram. Before installing/running: (1) Inspect the included script yourself — it will read the Cricbuzz URL you supply and may read ~/.openclaw/openclaw.json if you don't pass --bot-token. (2) Only provide a Telegram bot token for a bot you control (create a dedicated bot if you prefer least privilege). (3) Install gTTS in a virtual environment if you want voice memos. (4) Be aware scraping can break or violate a site's terms of service — expect fragility. (5) If you need stronger guarantees, run the script in an isolated container/VM and avoid pointing it at non-cricbuzz URLs.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fqzrkqcjrnz3qt5114a454182cen1

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments