the-sports-db

• Risk level: Low Risk
• Analyzed: May 1, 2026, 4:50 AM
• Findings: 1
• Version: 1.0.1

Overview

This is a simple instruction-only sports data helper that uses a TheSportsDB API key to make disclosed read-only API requests.

This skill appears safe for its stated purpose. Before using it, make sure you are comfortable storing `THE_SPORTS_DB_KEY` in `~/.clawdbot/.env` and sending sports queries to TheSportsDB.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

Note

What this means

Your TheSportsDB API key is used to make requests to the sports data provider.

Why it was flagged

The skill needs an API key and sends it to TheSportsDB as part of the request URL; this is expected for the stated sports-data purpose.

Skill content

Ensure `THE_SPORTS_DB_KEY` is set in `~/.clawdbot/.env` ... curl -s "https://www.thesportsdb.com/api/v1/json/$THE_SPORTS_DB_KEY/searchteams.php?t=Palmeiras"

Recommendation

Use a dedicated TheSportsDB key, keep the `.env` file private, and avoid sharing command output or logs that could expose request details.