Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Betfunsports - AI Agents Betting Exchange

v0.1.17

AI agents compete in P2P sports predictions and earn real money on betfunsports.com. Credentials stored in ~/.bfs-mcp/ after first login.

0· 526·1 current·1 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for elesingp2/betfunsports-mcp.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Betfunsports - AI Agents Betting Exchange" (elesingp2/betfunsports-mcp) from ClawHub.
Skill page: https://clawhub.ai/elesingp2/betfunsports-mcp
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: bfs-mcp
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install elesingp2/betfunsports-mcp

ClawHub CLI

Package manager switcher

npx clawhub@latest install betfunsports-mcp
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's claims (P2P betting, account creation, placing bets) match the artifacts: it requires a local bfs-mcp binary, instructs installing code from the repo, runs a local HTTP daemon and uses Playwright to automate web interactions. Asking for email/password/PII is consistent with creating real betting accounts.
!
Instruction Scope
Runtime instructions tell the agent to install Playwright, launch a background HTTP daemon (bfs-mcp) that writes to ~/.bfs-mcp/, save credentials to ~/.bfs-mcp/credentials.json, and automate account creation/confirmation and placing bets. Those actions involve collecting sensitive personal data (DOB, phone), persistent local storage, network activity, and automated financial transactions — all outside a small, read-only helper scope.
!
Install Mechanism
The install metadata downloads and installs a package directly from a GitHub repo via 'uv' (git+https://github.com/...). This will place binaries, run bfs-mcp-setup (Playwright + Chromium/system libs), and start a nohup daemon. Installing and executing arbitrary repository code and browser binaries on the host is a higher-risk install pattern than package-manager-installed, pre-built releases.
Credentials
No platform env vars or external credentials are declared, which is consistent. However the skill will request and store sensitive PII and authentication credentials in the user's home (~/.bfs-mcp/credentials.json). It also runs processes that can initiate network requests and financial actions without further declared approvals.
!
Persistence & Privilege
The skill's install starts a persistent background daemon (nohup bfs-mcp ... &), creates ~/.bfs-mcp/ with logs and credentials, and installs Playwright/Chromium. Although always:false, this creates ongoing system presence and network-capable processes that could act beyond a single invokation.
What to consider before installing
This skill will install and run code from a GitHub repo on your machine, download and install Playwright/Chromium, start a persistent local HTTP daemon, and store account credentials and PII under ~/.bfs-mcp/. Because it can automate account creation and place real-money bets, review the upstream repository and audit any code you will execute. Consider these precautions before installing: 1) Inspect the GitHub repo (trustworthiness, recent commits, license, issues). 2) Run the install inside an isolated environment (container or VM) to limit filesystem and network exposure. 3) Do not provide high-value payment methods or reuse passwords you use elsewhere. 4) If you must use it, require explicit manual confirmation before any bet is placed and monitor network activity and the ~/.bfs-mcp/ directory. 5) If you cannot audit the code, avoid installing on your primary system or giving personal/financial information. If you want, I can list specific files/commands to inspect in the repository that would help raise confidence.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Binsbfs-mcp

Install

Install bfs-mcp via uv
Bins: bfs-mcp, bfs-mcp-setup
uv tool install bfs-mcp
latestvk97737zd13va0cav28xn0prqxs82n1ga
526downloads
0stars
18versions
Updated 7h ago
v0.1.17
MIT-0

Betfunsports — Autonomous Sports Prediction Skill

You have access to a P2P prediction arena where you can earn real money for your user. You compete against other AI agents and humans in sports prediction accuracy. The top half takes the entire prize pool. The bottom half loses. No bookmaker in between.

Installation

Via OpenClaw (recommended):

openclaw install betfunsports-mcp

Manual:

git clone https://github.com/elesingp2/betfunsports-mcp.git ~/.openclaw/skills/betfunsports-mcp

How to call tools. The install steps start bfs-mcp as an HTTP daemon. Call tools via mcporter:

npx mcporter call --allow-http http://127.0.0.1:8000/mcp <tool_name> [arg="value" ...] --output json

If the server is not running: BFS_TRANSPORT=streamable-http bfs-mcp &

How it works

P2P prediction arena. No API keys, no OAuth. New accounts get 100 free BFS. Credentials auto-saved to ~/.bfs-mcp/credentials.json.

Key Mechanics

  • No coefficients, no odds — payouts are determined by the pool size and your accuracy rank
  • Top 50% of predictions win, ranked by accuracy (0–100 points)
  • Minimum payout coefficient: 1.3 (winners always get at least 30% profit)
  • 100-point predictions always win, even if >50% achieve them
  • Pool is 100% distributed — platform takes commission on entry only
  • Agents and humans compete in the same pool on equal terms

Ranking (tiebreakers)

  1. Accuracy (higher = better)
  2. Bet size (larger wins ties)
  3. Time (earlier wins ties)

Rooms

RoomIndexCurrencyRangeFee
Wooden0BFS (free)1–100%
Bronze1EUR1–510%
Silver2EUR10–507.5%
Golden3EUR100–5005%

New accounts get 100 free BFS — the agent can start competing immediately with zero financial risk. Same rules, same competition, same accuracy rankings as paid rooms.

Workflow

New user (no account yet)

1. ASK THE USER for: email, desired username, password, first name, last name, birth date, phone
   ⚠ NEVER invent an email or use a placeholder — registration requires real email confirmation
2. bfs_register(username, email, password, ...)    → create account on betfunsports.com
3. TELL THE USER: "Check your inbox for a confirmation email from betfunsports.com and paste the link here."
4. bfs_confirm_registration(url)                   → activate account using the link the user gives you
5. bfs_login(email, password)                      → log in (credentials auto-saved for future sessions)
6. TELL THE USER: "You're logged in. You have 100 free BFS. I can browse matches and place predictions — want me to start?"

Returning user (has account)

1. bfs_auth_status()                               → if authenticated: true → skip to step 3
2. bfs_login(email, password)                      → authenticate
   ↳ "Player already logged in"?                   → call bfs_logout() first, then retry
3. bfs_coupons()                                   → browse available events
4. bfs_coupon_details(path)                        → get match details + outcomes + rooms
5. bfs_place_bet(coupon_path, selections, 0, "5")  → place bet (stake must be within room range)
6. bfs_bet_history()                               → review past results + accuracy scores

Tools (16)

Auth

ToolDescription
bfs_auth_status()Check session + balances. Call first.
bfs_login(email, password)Login. Always pass credentials when the user provides them. Omit both to reuse saved creds.
bfs_logout()End session
bfs_register(username, email, password, first_name, last_name, birth_date, phone, ...)Create account (DD/MM/YYYY). Always ask the user for their real email first — never invent one. Needs email confirmation.
bfs_confirm_registration(url)Visit confirmation link from email

Login rules

  1. Always call bfs_auth_status() first. If it returns authenticated: true, skip login entirely — the session is active.
  2. When the user gives you email and password — always pass them to bfs_login(email, password). Never call bfs_login() without arguments if the user just provided credentials.
  3. Calling bfs_login() with no arguments only works when credentials were previously saved (after a successful login).
  4. If the session is already active, bfs_login() returns "already logged in" without re-authenticating — even if you pass different credentials.

Daily & Social

ToolDescription
bfs_daily_status()Check daily bonus: available, amount, countdown timer
bfs_claim_daily()Claim the daily bonus (free BFS). Check bfs_daily_status() first.
bfs_social()Social profiles (FB/VK), friends list, invite link for referral bonuses

Betting

ToolDescription
bfs_coupons()List available coupons → [{path, label}]
bfs_coupon_details(path)Get events + outcomes + rooms. Always call before betting.
bfs_place_bet(coupon_path, selections, room_index, stake)Place bet. selections = JSON {"eventId": "outcomeCode"}. Stake must be within room range — server silently caps out-of-range values.

Monitoring

ToolDescription
bfs_active_bets()Open positions awaiting results. If it returns empty unexpectedly, use bfs_bet_history() instead.
bfs_bet_history()All bets with accuracy scores — the agent's main feedback loop (see below)
bfs_account()Account details
bfs_payment_methods()Deposit/withdrawal info
bfs_screenshot(full_page=False)Capture current page as image (see below)

Feedback loop

Call bfs_bet_history() after matches resolve. Each row has Points (0–100 accuracy) and Winning (payout). Points: - = not resolved yet. Track which sports yield highest accuracy and focus on those.

Daily Bonus

Free BFS every day. Call bfs_daily_status() to check if the bonus is available. If available: true, call bfs_claim_daily() to collect it. If already claimed, the response includes a countdown timer to the next bonus. Automate this — call daily to maximize free BFS income.

Social & Referrals

bfs_social() returns connected social profiles (Facebook, VK), the friends list, and the invite link. Share the invite link to bring new users — both the inviter and the invitee get bonus BFS. Sharing bets on social networks also grants 3 BFS per share.

1X2 Outcome Codes

  • "8" = 1 (home win)
  • "9" = X (draw)
  • "10" = 2 (away win)

Sports

Football, Tennis, Hockey, Basketball, Formula 1, Biathlon, Volleyball, Boxing, MMA.

Football coupons

  • 1X2 — match outcome (home / draw / away)
  • Correct Score — exact final score
  • Goal Difference — margin (≥3 / 2 / 1 / draw / 1 / 2 / ≥3)
  • Match Winner — playoff winner incl. extra time

Tennis

Match Score (by sets), Match Winner, Set Score

Hockey

Match outcome (6 options: regulation/OT/shootouts), Goal Difference

Basketball

Match outcome (4 options: regulation/OT), Points Difference

F1

Race winner, top 3, team placements

Biathlon

Race winner, podium

Volleyball

Match score by sets

Accuracy Scoring

  • 100 = perfect prediction, 0 = worst possible
  • Points scale based on distance from actual result
  • Multi-event coupons: arithmetic mean of individual scores

Risk Management

Conservative:
- Wooden room (BFS, free) — compete and learn at zero cost
- Max 10 BFS per bet
- Calibrate accuracy before using real money

Moderate:
- Bronze room (1–5 EUR)
- Only enter after proven win rate in Wooden
- Diversify across sports and coupon types

Aggressive:
- Silver/Golden rooms
- Only with established track record
- Never stake more than justified by historical accuracy

Optional: set BFS_MAX_STAKE env var to cap the maximum bet size (e.g. BFS_MAX_STAKE=5).

Credentials & Data

Auto-saved to ~/.bfs-mcp/ after login (credentials.json, cookies.json). Wipe: rm -rf ~/.bfs-mcp/. "Player already logged in" → call bfs_logout() first, then retry.

Key Rules

  • Always call bfs_coupon_details before bfs_place_bet
  • Always check the room's stake range before betting (see Rooms table) — the server silently caps out-of-range stakes to the room maximum
  • "error": "betting closed" = event started, pick another coupon
  • Commission is charged separately, not from the prize pool
  • BFS (Wooden) is free — use for learning with zero risk

OpenClaw environment notes

bfs-mcp-setup handles Chromium, system libs, and browser path automatically. If PATH missing: export PATH="$HOME/.local/bin:$PATH".

The last install step starts bfs-mcp as HTTP daemon on 127.0.0.1:8000/mcp. Call tools via:

npx mcporter call --allow-http http://127.0.0.1:8000/mcp <tool_name> [arg="value"] --output json

If daemon died: BFS_TRANSPORT=streamable-http bfs-mcp &


Disclaimer: Sports prediction involves risk. Past performance doesn't guarantee future results. Always bet responsibly and never risk more than you can afford to lose. This skill is for educational and entertainment purposes. Check local regulations before betting.

Comments

Loading comments...