Cricket Live

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears to do what it advertises—fetch cricket scores from CricketData—but it needs an API key and can optionally run recurring alert checks.

Before installing, be comfortable creating and storing a CricketData API key, allowing scripts to call api.cricapi.com, and optionally enabling cron-based alerts. Verify curl and jq are installed, and avoid putting the API key in shared files.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Your CricketData API key can be used to consume your API quota and should be kept private.

Why it was flagged

The scripts send the user-provided CricketData API key to the CricketData API. This is expected for the advertised function, but it is still credential use.

Skill content

BASE_URL="https://api.cricapi.com/v1" ... local url="${BASE_URL}/${endpoint}?apikey=${key}" ... curl -s --max-time 10 "$url"

Recommendation

Use a limited CricketData key via CRICKET_API_KEY, avoid committing it to shared config files, and rotate it if it is exposed.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may fail or prompt for setup unless curl, jq, and the API key are available, even though the registry metadata says no requirements.

Why it was flagged

The package declares runtime requirements that are not reflected in the registry metadata shown as having no required binaries or env vars. This is a setup transparency issue, not hidden behavior.

Skill content

"requiredEnv": ["CRICKET_API_KEY"], "requirements": { "bins": ["curl", "jq"] }

Recommendation

Verify the source and ensure curl, jq, and CRICKET_API_KEY are configured before relying on the skill.

Note

ASI10: Rogue Agents

What this means

If you enable cron, the script will keep making periodic API calls and store alert state locally until you remove the schedule or state file.

Why it was flagged

The skill documents optional recurring cron execution and a local state file for alerts. It is disclosed and user-directed.

Skill content

Set up periodic match alerts ... */5 9-23 * * * CRICKET_API_KEY="your-key" bash /path/to/skills/cricket-scores/scripts/cricket-alert.sh ... tracks state in `/tmp/cricket-alert-state.json`

Recommendation

Only add the cron entry if you want background alerts; set a reasonable frequency and remove the cron job and /tmp state when no longer needed.