ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Football Automated Value Betting

v1.0.0

Automates real-time value betting on Singbet Asian Handicap markets using live odds and in-play football data with risk management and bet limits.

⭐ 0· 1.3k·0 current·0 all-time
bywin8-blip@hga030888-blip
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill claims to monitor live odds (The Odds API) and execute bets on Singbet — the provided code implements fetching odds and local bet-tracking and includes placeholders for placing bets. However the skill metadata declares no required credentials/env vars while the runtime instructions explicitly ask for an API key and betting account credentials. file (1).json even contains a hard-coded api_key and platform/agent URLs, which is inconsistent with the registry's 'no required env vars' declaration and suggests secrets are embedded rather than managed securely.
ℹ
Instruction Scope
SKILL.md instructs the agent to obtain a The Odds API key, configure betting account credentials, monitor live match indices, and execute bets. The instructions do not request unrelated system files or environment values, but they do authorize sending transaction data to external betting endpoints (Singbet/hga030/sangbet.com). The code's execute_singbet_bet is a placeholder (no real session/auth), so actual automated execution would require additional credentials and web-automation not present here.
✓
Install Mechanism
This is an instruction-only skill with no install spec and only a small Python file. No additional packages or remote downloads are specified, so there is low installation risk.
!
Credentials
The skill asks the user (in SKILL.md) to provide The Odds API key and betting account credentials but declares no required environment variables. Instead an api_key is hard-coded in file (1).json. That is disproportionate and inconsistent: sensitive credentials are expected yet not declared for secure injection, and a secret-like value is embedded in the code/config file. The skill also references external betting platforms (hga030.com, sangbet.com) without clear, secure authentication mechanisms.
✓
Persistence & Privilege
The skill does not request always-on presence, does not modify other skills or global agent configuration, and does not request system-level config paths. It operates with normal autonomy defaults (agent invocation allowed), which is expected for this use case.
What to consider before installing
What to consider before installing: - The skill asks you to provide an API key and betting-account credentials but does not declare any env vars for secure injection; instead an api_key-like value is embedded in the shipped JSON. Treat that as a red flag: do not assume the embedded key is safe or valid. - Automated betting carries real financial and legal risk. Confirm local laws permit this activity and be prepared for monetary loss. - If you proceed, require the developer to: (1) remove hard-coded secrets from shipped files, (2) declare required environment variables (e.g., ODDS_API_KEY, SINGBET_USER / SINGBET_PASS or token) so you can supply credentials securely, and (3) provide a clear, auditable implementation of how bets are executed (authentication, endpoints, and error handling). - Prefer to test in a sandbox: run the skill in an isolated environment with fake/test credentials and no real funds before enabling any real execution. If the embedded api_key is real, rotate/revoke it. - If you need a quick safety checklist: ask the author for (A) explicit list of required secrets, (B) proof that the skill does not exfiltrate local files or unrelated credentials, and (C) assurance that actual bet execution is gated behind an explicit, user-confirmed step (not fully autonomous). Confidence note: assessment is medium confidence because the code is short and the actual bet-execution is a placeholder; the main issues are the credential handling inconsistencies and the presence of a hard-coded api_key in the config JSON.

Like a lobster shell, security has layers — review code before you run it.

bettingvk97c991spvvwjazdgqvczamwf580rz09latestvk97c991spvvwjazdgqvczamwf580rz09

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments