Lottery
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: lottery Version: 3.0.0 The lottery skill bundle is a straightforward utility for generating and checking lottery numbers. The shell script (scripts/script.sh) uses standard system utilities like shuf and wc to perform its functions and stores data locally in the user's home directory as documented. No evidence of malicious intent, data exfiltration, or suspicious execution was found.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill runs local shell commands when invoked, but the shown commands are narrow and purpose-aligned.
The skill invokes a local Bash script and standard command-line utilities to generate lottery numbers. This is expected for the stated purpose and not hidden, but users should recognize that installing it enables local script execution.
#!/usr/bin/env bash ... cmd_powerball() { echo 'Numbers: '$(shuf -i 1-69 -n 5 | sort -n | tr '\n' ' ')Install only if you are comfortable running the included Bash script; no additional mitigation is needed for the evidenced behavior.
The skill may generate or check numbers incorrectly, so a user could trust inaccurate results.
The implementation appears to use shifted positional arguments incorrectly, and the check command prints literal placeholders rather than actually comparing submitted and winning numbers. This is a reliability caveat, not evidence of malicious behavior.
shuf -i 1-${3:-49} -n ${2:-6} ... echo 'Your: $2 Winning: $3'Verify lottery picks and result checks manually or ask the maintainer to fix the argument handling before relying on these commands.