ClawHub
Back to skill

Security audit

Tennis Live-State Gate

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed, observe-only tennis market gate that reads live sports data and returns a trade/no-trade sizing suggestion without placing orders.

Install only if you are comfortable giving this skill a Live Tennis API key and, for --live-data, a Simmer API key to list markets. Treat its output as decision support, not financial advice or an automated trading system, and verify the external data source and staleness settings match your risk tolerance.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill documentation describes use of environment variables for API keys and outbound network access to third-party services, yet the finding indicates no declared permissions. That mismatch is a real security issue because consumers may invoke the skill without understanding it reads secrets from the environment and transmits data externally, undermining least-privilege review and consent.

Static analysis

No suspicious patterns detected.