Cricket Live Score
Analysis
The skill is coherent for sending cricket scores to Telegram, but users should notice that it uses a Telegram bot token, runs a background updater, and depends on external network services.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
The script runs in the background, sends updates at your chosen interval, and auto-stops when the match ends.
The skill intentionally starts a long-running updater. This is disclosed and aligned with live score alerts, but users should understand it will continue posting until stopped or completed.
dependencies: gTTS
Voice memos depend on the external gTTS package, while the registry shows no install spec. This is a purpose-aligned optional dependency, but users may need to install and trust it separately.
if not parsed.hostname or not parsed.hostname.endswith('cricbuzz.com'):The script validates user-provided score URLs by suffix matching. This supports the intended Cricbuzz-only workflow, but a stricter exact-domain or subdomain check would reduce the chance of accepting a lookalike host.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
config_path = os.environ.get("OPENCLAW_CONFIG", os.path.expanduser("~/.openclaw/openclaw.json")) ... return config["channels"]["telegram"]["botToken"]The script can read a Telegram bot token from the local OpenClaw config if a token is not supplied directly. This is purpose-aligned for sending Telegram updates, but it is credential use.