ClawHub
Back to skill

Security audit

Football Automated Value Betting

Security checks for vulnerabilities and agentic risk

Overview

This skill is framed as automated sports betting and includes real-money-style execution claims without adequate user confirmation, while its betting function falsely reports success.

Review this skill carefully before installing. It is not merely an odds-analysis helper: its instructions aim for automated betting, and the advertised safeguards do not provide clear user approval or reliable transaction verification. Treat the included API key as exposed, replace it with your own secret-management approach, and do not rely on the betting function's success messages as proof that a wager was actually placed.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
file (1).json:14
Finding

Hardcoded The Odds API Credential in Skill Configuration

Content
View full analysis
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Warning
Location
file.py:28
Finding

Betting Tool Spoofs Successful Execution and Does Not Enforce Advertised Risk Controls

Content
View full analysis
stats["last_reset"]: stats["daily_count"] = 0 stats["last_reset"] = datetime.date.today() if stats["daily_count"] >= 30: return "Error: Daily limit of 30 bets reached." # Placeholder for actual API/Web-automation logic # Example: session.post("https://sangbet.com/api/place", data=...) bet_entry = { "timestamp": datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S"), "event_id": event_id, "market": market, "odds": odds, "amount": f"$${amount}$$" } stats["history"].append(bet_entry) stats["total_bets"] += 1 stats["daily_count"] += 1 return f"Bet Successfully Placed: {market} at {odds} for $${amount}$$." def get_betting_statistics(): """Returns the performance summary.""" return { "total_placed": stats["total_bets"], "today_count": stats["daily_count"], "recent_activity": stats["history"][-5:] } ``` ### Technical Analysis The function is presented as a real betting-execution tool, but it does not make an outbound request to Singbet or verify that a transaction occurred. The only network operation is a commented example. Nevertheless, the function increments its counters and returns `Bet Successfully Placed`, causing callers to receive a fabricated success result. The advertised safeguards are also incomplete: - The fixed USD 10 stake is only a default parameter. A cal ...[truncated 2451 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly instructs the agent to execute real-money bets automatically via execute_singbet_bet but does not require an explicit user-facing warning, consent checkpoint, or transaction confirmation. This is especially dangerous because the prompt operationalizes autonomous wagering with API access, fixed stakes, and daily limits, which can still produce repeated financial loss or unauthorized gambling activity if triggered incorrectly.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

This function is explicitly described as executing a bet on an external betting platform and returns a success message indicating the bet was placed, yet it contains no confirmation prompt, explicit warning, or user-facing disclosure about the irreversible financial action. Even though the current implementation is partly placeholder logic, the stated behavior is a safety-critical operation that should require clear user acknowledgment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is broadly framed around automated football betting and lacks narrow invocation boundaries, making it more likely to activate on general betting-related prompts rather than explicit, well-scoped user requests. In a real-money wagering context, overbroad triggering increases the chance of unauthorized or unintended betting analysis and downstream bet placement, especially when paired with an execution tool.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · file.py (reported line 16)May include surrounding context.

python
"""
    Fetches real-time in-play odds from The Odds API.
    """
    url = f"https://api.the-odds-api.com/v4/sports/{sport}/odds/"
    params = {
        "apiKey": api_key,
        "regions": "as",  # Focus on Asian markets

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The code makes an external HTTP request to a third-party odds API using the provided API key, but there is no confirmation prompt, logging, or warning to inform the user that credentials and request parameters will be transmitted off-system. Network transmission of secrets and usage data is safety-relevant and should be disclosed when not otherwise obvious to the user.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The function claims to execute a real bet and returns a success message, but it only appends a local history entry. This deceptive behavior is dangerous because downstream agents or users may believe a wager was actually placed, causing financial, compliance, or operational errors such as duplicate betting or missed hedges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill advertises automated execution against live betting portals and instructs users to configure stored credentials, but it does not prominently warn that it can place real-money wagers automatically. That omission increases the risk of a user enabling or invoking the skill without fully understanding that it may perform irreversible financial actions on a gambling account.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.