Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Nba Basketball
v1.0.1提供NBA球队、球员、赛程、比分及新闻资讯，实时掌握美国职业篮球联赛信息。
⭐ 0· 69·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill name/description promise real-time NBA data (teams, players, schedules, scores, news). However the SKILL.md is a generic 'information station' / corporate-profile outline (history, business scope, global layout, latest dynamics) and gives no instructions for fetching live sports data, no endpoints, and no required credentials. This misalignment suggests the skill either is incomplete or mislabelled.
Instruction Scope
SKILL.md contains only metadata (read_when triggers) and a high-level content outline; it does not instruct the agent to call any APIs, scrape sites, or access local files. That makes it low-risk from a data-access perspective but also insufficient to deliver the promised real-time functionality. The vagueness grants the implementer broad latitude (e.g., how to obtain data) which is a concern.
Install Mechanism
No install/spec and no code files are present; this is instruction-only, so nothing will be written to disk or downloaded during install. Low install risk.
Credentials
The skill declares no required environment variables, credentials, or config paths. There's no evidence of excessive credential requests.
Persistence & Privilege
always is false and autonomous invocation is default. The skill does not request elevated persistence or modify other skills/config — nothing unusual here.
What to consider before installing
This skill's description and its runtime instructions don't match. Before installing: ask the publisher where live NBA data comes from (which APIs or feeds), whether any API keys are required, and for a homepage or source repository to review code. If you need real-time scores/news, prefer a skill that documents the data source and required credentials; avoid using this one until the author provides a clear implementation or updates SKILL.md to reflect how data is fetched and kept current.Like a lobster shell, security has layers — review code before you run it.
latestvk970e2wn0w0th565a33f84vdqh84wz38
License
MIT-0
Free to use, modify, and redistribute. No attribution required.