FootballBin Predictions

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to only fetch football prediction data from a disclosed public API without credentials, installs, local file access, or persistence.

This looks safe for its stated purpose. Before installing, note that it sends your football query parameters to the disclosed FootballBin API and depends on local curl and jq binaries, but the provided artifacts do not show credential use, local data access, persistence, or hidden behavior.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Info

#ASI07: Insecure Inter-Agent Communication

What this means

Your league, matchweek, and team filter choices are sent to the FootballBin API to return predictions.

Why it was flagged

The skill communicates with a remote MCP-style JSON-RPC endpoint, but the endpoint and limited data sent are clearly disclosed and match the stated prediction purpose.

Skill content

External Endpoints

- Host: `api.footballbin.achaninc.net`
- Path: `/mcp`
- Method: `POST` (JSON-RPC)
- Data sent: league, optional matchweek, optional team filters

Recommendation

Install only if you are comfortable sending those query choices to the disclosed FootballBin service.

Info

#ASI02: Tool Misuse and Exploitation

What this means

Running the skill makes a network request to retrieve prediction data, but the script does not show unrelated shell actions or local system changes.

Why it was flagged

The included script uses curl to call the prediction API, which is expected for this skill; arguments are constrained to league, numeric matchweek, and validated team strings.

Skill content

curl --fail --show-error --silent --max-time 20 -X POST "$MCP_ENDPOINT" ... -d "$payload"

Recommendation

Use the documented commands and verify the endpoint remains the disclosed FootballBin API if you review future versions.