Agentsports

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:36 AM UTC
• Version: 0.1.3

Overview

The skill’s sports-prediction purpose is clear, but it installs mutable external code and handles account passwords and saved sessions in ways users should review first.

Install only if you are comfortable with a GitHub-sourced CLI, sending personal data and credentials to agentsports.io, and having session material saved locally under ~/.asp/. Use a unique password, consider running it in a constrained environment, set ASP_MAX_STAKE before predictions, and review every real-money action before confirming.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:5

Finding

Unpinned Remote Git Repository Is Installed as Executable Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned remote dependency and mutable remote payload
Risk Level: High

Vulnerable Code

yaml

metadata: {"openclaw": {"requires": {"bins": ["asp"], "config_paths": ["~/.asp/"]}, "homepage": "https://agentsports.io", "install": [{"id": "uv", "kind": "uv", "package": "agentsports", "args": ["--from", "git+https://github.com/elesingp2/agentsports-connect.git"], "bins": ["asp"], "label": "Install agentsports via uv", "env": {"UV_CACHE_DIR": "/workspace/.uv-cache"}}, {"id": "path", "kind": "shell", "command": "export PATH=\"$HOME/.local/bin:$PATH\"", "label": "Add bin dir to PATH"}]}}

Technical Analysis

The installation configuration retrieves the agentsports package directly from a mutable GitHub repository. The URL does not specify an immutable commit hash, verified release artifact, or integrity digest.

Because the effective implementation is hosted outside the audited project, its contents can change after this Skill has been reviewed. Installation can execute package build hooks, installation logic, and subsequently the installed asp command with the user's privileges. The project itself only contains SKILL.md, so the remotely installed implementation could not be statically reviewed as part of this audit.

This is both a supply-chain weakness and a remote payload execution channel. Trust is placed in the continuing integrity of the repository, its maintainers, GitHub accounts, build configuration, and transitive dependencies.

Attack Path

1. An attacker compromises a maintainer account, repository, release workflow, or other upstream component.
2. The attacker modifies the repository to include malicious installation hooks or malicious asp behavior.
3. A user installs or reinstalls the Skill using the declared uv installation configuration.
4. uv retrieves the current repository contents rather than an aud ...[truncated 794 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the Git dependency to a reviewed, immutable full commit hash.
2. Prefer a trusted package registry release with a fixed version and cryptographic hashes.
3. Maintain a lock file covering all transitive dependencies and verify integrity during installation.
4. Vendor the reviewed implementation into the project when practical so the effective code is included in future audits.
5. Require signed commits or release artifacts and verify signatures before installation.
6. Run installation and the CLI in a sandbox with minimal filesystem, credential, and network access.
7. Establish a controlled update process in which every new upstream revision is reviewed before the pinned reference is changed.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:47

Finding

Account Passwords Are Required in Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47, 54, 70, 118, and 134-135
Vulnerability Type: Sensitive credential exposure through process arguments and execution logs
Risk Level: Medium

Vulnerable Code

text

6. asp login --email [e-mail] --password s3cret    → 100 free ASP tokens

text

2. asp login --email ... --password ...         → authenticate

markdown

| `asp login --email ... --password ...` | Login. **Always pass credentials when user provides them.** Omit both to use saved. |

markdown

| `asp_login(email, password)` | `asp login --email ... --password ...` |

markdown

2. **Always pass email+password** when the user provides them.
3. `asp login` with no args uses saved credentials only.

Technical Analysis

The Skill repeatedly instructs the agent to place a user's plaintext password directly in the asp process argument list. It expressly mandates this behavior whenever the user provides credentials.

Command-line arguments are not an appropriate secret transport mechanism. Depending on the operating system and execution environment, they may be exposed through process inspection, shell history, terminal transcripts, orchestration metadata, audit facilities, debugging output, agent tool traces, or retained execution logs. Even if process visibility is restricted, the agent must reproduce the plaintext password in a tool invocation, increasing the number of systems that may retain it.

The documentation also states that credentials and session cookies are automatically saved under ~/.asp/, but it does not establish storage encryption or restrictive permissions. That storage behavior warrants hardening, although the external CLI implementation was unavailable to determine its actual protections.

Attack Path

1. A user supplies an email address and password to the agent.
2. Following the Skill instructions, the agent c ...[truncated 1210 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove instructions that require passwords to be passed with --password.
2. Modify the CLI to accept passwords through a protected interactive no-echo prompt or standard input.
3. Where supported, use an operating-system credential manager or a narrowly scoped authentication token instead of storing account passwords.
4. Ensure secrets are redacted from agent messages, tool invocations, shell history, telemetry, error reports, and debug logs.
5. If environment variables must be used as a transitional measure, ensure they are injected by a secret manager and never printed or persisted; protected standard input is preferable.
6. Store session material with restrictive owner-only permissions and use platform-backed encryption where available.
7. Document credential deletion, expiration, and rotation procedures.
8. Add automated tests confirming that passwords never appear in process arguments or application logs.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md

## Credentials & Data

Session cookies and credentials are auto-saved to `~/.asp/` (enables auto-relogin). Wipe: `rm -rf ~/.asp/`.

## Exit Codes (CLI)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md

## Credentials & Data

Session cookies and credentials are auto-saved to `~/.asp/` (enables auto-relogin). Wipe: `rm -rf ~/.asp/`.

## Exit Codes (CLI)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md

## Credentials & Data

Session cookies and credentials are auto-saved to `~/.asp/` (enables auto-relogin). Wipe: `rm -rf ~/.asp/`.

## Exit Codes (CLI)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The registration command requires --birth-date DD/MM/YYYY, which imposes a locale-specific date format in the natural-language instructions. The document does not offer an alternative format or explain why this locale constraint is required, so it may violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.