sports-data-analysis

• Outcome: Review
• Latest audit: Oct 14, 2026 · 6:42 AM UTC
• Version: 2.10.2

Overview

The skill is mostly a sports report generator, but it needs Review because it can write persistent files, fetch arbitrary URLs, mutate local JSON data, and contains outcome-probability/reporting behavior that conflicts with its “no result judgment” claims.

Install only if you are comfortable with a Chinese-language sports report skill that creates Desktop HTML files, uses web/API access for sports data, and may modify packaged or user-supplied JSON files. Prefer running it with explicit outputs, avoid arbitrary --url fetches, and review generated reports for probability or directional language if you need strictly non-predictive content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (64)

Tainted flow: 'req' from os.environ.get (line 2139, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/analytics.py (reported line 2141)May include surrounding context.

python

q = urllib.parse.quote(team)
        req = urllib.request.Request(base + "/searchteams.php?t=" + q,
                                     headers={"User-Agent": "Mozilla/5.0 (compat; sports-data-analysis)"})
        with urllib.request.urlopen(req, timeout=15) as resp:
            tdata = json.loads(resp.read().decode("utf-8"))
        teams = (tdata.get("teams") or []) if isinstance(tdata, dict) else []
        if not teams:

Tainted flow: 'req2' from os.environ.get (line 2157, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/analytics.py (reported line 2159)May include surrounding context.

python

if id_team:
            req2 = urllib.request.Request(base + "/eventslast.php?id=" + str(id_team),
                                         headers={"User-Agent": "Mozilla/5.0 (compat; sports-data-analysis)"})
            with urllib.request.urlopen(req2, timeout=15) as resp2:
                edata = json.loads(resp2.read().decode("utf-8"))
            evs = (edata.get("results") or []) if isinstance(edata, dict) else []
            for e in evs[:5]:

Tainted flow: 'req' from os.environ.get (line 2139, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The fetch command accepts a user-supplied URL and passes it directly to urllib.request.urlopen without any allowlisting or scheme/host validation. This can be abused for SSRF-like behavior from the runtime environment, enabling access to internal services, metadata endpoints, or unexpected local/network resources depending on where the skill runs.

Content

Scanner excerpt · scripts/analytics.py (reported line 2186)May include surrounding context.

python

a.url,
                headers={"User-Agent": "Mozilla/5.0 (compat; sports-data-analysis)",
                         "Accept": "application/json"})
            with urllib.request.urlopen(req, timeout=15) as resp:
                data = json.loads(resp.read().decode("utf-8"))
            keys = list(data.keys())[:20] if isinstance(data, dict) else []
            print("✅ 已抓取：%s" % a.url)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Refreshing and injecting expert commentary into persistent JSON assets is more akin to a backend content-maintenance workflow than a simple report generator. The security concern is not the feature itself but the undisclosed persistent mutation of local data and the broader-than-advertised operational behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Refreshing and injecting expert commentary into persistent JSON assets is more akin to a backend content-maintenance workflow than a simple report generator. The security concern is not the feature itself but the undisclosed persistent mutation of local data and the broader-than-advertised operational behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Refreshing and injecting expert commentary into persistent JSON assets is more akin to a backend content-maintenance workflow than a simple report generator. The security concern is not the feature itself but the undisclosed persistent mutation of local data and the broader-than-advertised operational behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Refreshing and injecting expert commentary into persistent JSON assets is more akin to a backend content-maintenance workflow than a simple report generator. The security concern is not the feature itself but the undisclosed persistent mutation of local data and the broader-than-advertised operational behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

Refreshing and injecting expert commentary into persistent JSON assets is more akin to a backend content-maintenance workflow than a simple report generator. The security concern is not the feature itself but the undisclosed persistent mutation of local data and the broader-than-advertised operational behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Refreshing and injecting expert commentary into persistent JSON assets is more akin to a backend content-maintenance workflow than a simple report generator. The security concern is not the feature itself but the undisclosed persistent mutation of local data and the broader-than-advertised operational behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Refreshing and injecting expert commentary into persistent JSON assets is more akin to a backend content-maintenance workflow than a simple report generator. The security concern is not the feature itself but the undisclosed persistent mutation of local data and the broader-than-advertised operational behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases are extremely broad, including common requests like 'analysis report' or 'example demo', and the instructions force immediate execution without clarifying intent first. That raises the chance of accidental invocation leading to network activity, file creation, and report rendering when the user did not intend to run this skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The docstrings and comments say the report body does not evaluate match outcomes, yet other code paths do exactly that via explicit probability modeling. This misleading safety narrative reduces user and reviewer scrutiny and increases the chance the predictive feature is deployed in contexts that were supposed to forbid it.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code generates and displays match-outcome probabilities and model-vs-consensus deltas while the skill description and in-file declarations claim it does not make result judgments. In this skill context, that contradiction is materially dangerous because it can mislead users about the tool's purpose and facilitate de facto betting guidance despite repeated disclaimers.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The refresh command rewrites the input JSON file in place by default after merging patches and fetched data, with no confirmation or backup. In a skill/agent setting, that behavior can destroy source data integrity or persist attacker-influenced modifications unexpectedly, especially if run on important local files.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation promises that strict mode treats missing gender declarations as failures, but the implementation only adds a note and never creates a corresponding issue, so expected blocking behavior does not occur. This can cause the quality gate to pass data that operators believe would be rejected, undermining enforcement and allowing mislabeled or inferred sensitive-attribute data to slip through production workflows.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The docstring claims that result-prediction and directional betting-like conclusions are filtered out before injection, but the code performs no such validation and blindly copies fresh[name] into live match records. In this sports-analysis context, that gap can allow prohibited or misleading recommendation content to be surfaced under a false compliance assurance, undermining safeguards and enabling policy bypass through the fresh_experts.json input.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents capabilities that imply network access, environment-variable use, and local file read/write, but it does not declare any tool scope or permissions boundary. That creates an authorization gap where the runtime may expose broader capabilities than users or reviewers expect, increasing risk of over-privileged execution and unsafe file/network actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill's display name, description, examples, and user-facing instructions are entirely in Chinese, and the prescribed trigger and response language are Chinese-only. There is no indication that the user can opt into another language or locale, which can violate language/locale choice expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs writing generated HTML reports to the user's desktop while presenting itself mainly as an information-organization tool. Undeclared local file creation can surprise users, leak sensitive filenames/paths into shared environments, and create persistence on disk without clear consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly directs writing HTML files to the user’s desktop and presenting them, but does not require an up-front warning or consent for local file creation. Silent writes to a prominent user directory are risky because they create persistent artifacts, may overwrite expectations about local state, and can expose content on shared machines.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documented workflow includes active web collection, expert aggregation, and automated refresh behavior that goes beyond the simple stated purpose. This matters because it changes the data-trust, privacy, and execution-risk model: the skill is not just formatting provided data, it is sourcing and transforming content from the network.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This manifest-style JSON stores all analyst tiers and narrative 'view' fields in Chinese, while referencing international sports events and English source names. Because there is no indication that the skill is China-specific or that users can opt into Chinese output, this creates a natural-language locale policy concern under the requirement not to force a specific language without user choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This entry is labeled as merely source attribution and 'not making outcome judgments', but it contains substantive expert-style analysis such as series state, player-specific factors, and strategic determinants. That mismatch can mislead downstream systems, reviewers, or users into treating advisory content as neutral metadata, which is risky in a sports-analysis skill that explicitly claims not to provide betting-style judgment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The content goes beyond attribution by describing series lead, key offensive variables, and what determines the matchup, while still being labeled as non-judgmental source marking. This creates a policy-bypass style issue where substantive analysis is embedded in a supposedly safe classification, making compliance and user transparency weaker.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This record includes expert commentary about series leverage, pitching suppression, bullpen performance, and variability, despite the disclaimer that it is only source labeling and not a result judgment. Even without explicit predictions, such framing can be consumed as betting-adjacent guidance or hidden analysis, contrary to the skill's stated boundaries.

Content

No source excerpt is available for this finding.