Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Lottery

Lottery - command-line tool for everyday use

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 34 · 0 current installs · 0 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (a local lottery CLI) match the code's behavior: the script reads/writes local files under ~/.local/share/lottery and provides generation, export, search, and logging features. However, SKILL.md claims a configurable LOTTERY_DIR environment variable and lists commands (e.g., list, add) that are not implemented in the visible script, indicating the documentation and implementation are inconsistent.
!
Instruction Scope
SKILL.md instructs users to set LOTTERY_DIR to change the data directory and documents a small set of commands; the script, however, does not read LOTTERY_DIR (it hardcodes DATA_DIR from HOME) and exposes many additional commands. This mismatch grants the agent/documentation an inaccurate view of what will run and where data is stored. The script logs all user inputs to local files (history.log and per-command .log files), so any secrets a user types would be stored locally.
Install Mechanism
No install spec; this is an instruction-only skill with a shell script included. No downloads or third-party package installs are present, so there's no additional network-based installation risk in the bundle itself.
Credentials
The skill declares no required env vars or credentials. The script implicitly uses HOME to derive ~/.local/share/lottery and writes files there. That is proportionate to a local CLI, but SKILL.md's mention of LOTTERY_DIR is unfulfilled by the script (a mismatch). Also be aware that the tool will persist any inputs you provide into log files in your home directory.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system-wide configs, and only writes to its own directory under the user's home. It does persist data locally (logs and exports) which is expected for this type of tool.
What to consider before installing
This skill is likely what it says (a local CLI that stores logs and can export them), but the documentation and script don't fully match: SKILL.md mentions LOTTERY_DIR and some commands that the script does not use/implement. Before installing, review the full script to confirm behavior (search for any network calls or execs beyond what's visible). Note that the tool writes all inputs to ~/.local/share/lottery/ by default (history.log and per-command logs) — avoid entering secrets or sensitive data via the tool unless you trust and/or edit it to change the storage location. If you need LOTTERY_DIR support or different commands, ask the author for an updated release or modify the script to honor a directory env var (e.g., check LOTTERY_DIR and fall back to HOME).

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.1
Download zip
latestvk975q8zqqsqze0cb78hqaf90qx831yv6

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Lottery

Lottery toolkit — number generator, odds calculator, result checker, and statistics.

Commands

CommandDescription
lottery helpShow usage info
lottery runRun main task
lottery statusCheck state
lottery listList items
lottery add <item>Add item
lottery export <fmt>Export data

Usage

lottery help
lottery run
lottery status

Examples

lottery help
lottery run
lottery export json

Output

Results go to stdout. Save with lottery run > output.txt.

Configuration

Set LOTTERY_DIR to change data directory. Default: ~/.local/share/lottery/


Powered by BytesAgain | bytesagain.com Feedback & Feature Requests: https://bytesagain.com/feedback

Features

  • Simple command-line interface for quick access
  • Local data storage with JSON/CSV export
  • History tracking and activity logs
  • Search across all entries

Quick Start

# Check status
lottery status

# View help
lottery help

# Export data
lottery export json

How It Works

Lottery stores all data locally in ~/.local/share/lottery/. Each command logs activity with timestamps for full traceability.

Support

Powered by BytesAgain | bytesagain.com | hello@bytesagain.com

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…