Sports Odds

Retrieve live betting odds and compare moneyline, spreads, and totals across sportsbooks for NFL, NBA, MLB, NHL, and other sports using The Odds API.

Security Scan

The skill's behavior (curl + jq calls to The Odds API using an ODDS_API_KEY) matches its stated purpose, but the published registry metadata omits the required API credential declared inside SKILL.md — a manifest mismatch that could mislead users about what secrets the skill will use.

Purpose & Capability

Name/description, examples, and required binaries (curl, jq) align with retrieving odds from The Odds API. However, the registry metadata provided with the skill claims no required env vars or primary credential, while the SKILL.md explicitly documents and uses an ODDS_API_KEY — an inconsistency between declared registry fields and the runtime instructions.

Instruction Scope

SKILL.md only instructs the agent to call The Odds API endpoints with curl and parse responses with jq. It reads the ODDS_API_KEY environment variable and suggests caching responses; there are no instructions to read unrelated files, system state, or to exfiltrate data to third-party endpoints beyond api.the-odds-api.com.

Install Mechanism

No install spec or code files — instruction-only. This is low-risk from an install perspective because nothing is written or executed beyond the agent following the curl/jq commands at runtime.

Credentials

The only sensitive item used is an API key (ODDS_API_KEY), which is appropriate for the stated purpose. The concern is that the skill package/registry metadata did not list this required environment variable or primary credential, while SKILL.md does — this mismatch can cause the platform or user to miss that a secret will be used and transmitted to api.the-odds-api.com.

Persistence & Privilege

Skill is not always-enabled, does not request persistent system changes, and contains no install-time modifications. Autonomous invocation is allowed (platform default) but not combined with other red flags here.

Scan Findings in Context

[no-findings] expected: The static scanner had no code to analyze (instruction-only). The SKILL.md contains network calls to api.the-odds-api.com and usage of an ODDS_API_KEY, which is expected for this skill's purpose.

What to consider before installing

This skill appears to do what it says (call The Odds API using curl and jq). Before installing: (1) be aware it requires an API key (ODDS_API_KEY) which will be sent to api.the-odds-api.com — create a dedicated key with limited quota and do not reuse sensitive keys; (2) verify the skill's source/owner (source is unknown here) or prefer packages from known publishers; (3) ask the publisher/maintainer to correct the registry metadata so the required credential is declared up front; and (4) monitor API usage after enabling the skill. If you cannot confirm the publisher or prefer not to expose an API key, do not install.

Sports Betting Odds

Get live betting odds from multiple sportsbooks using The Odds API. Free tier includes 500 requests/month.

Setup

1. Get a free API key at https://the-odds-api.com/
2. Set the environment variable: export ODDS_API_KEY=your_key_here

Available Sports

List all available sports:

curl -s "https://api.the-odds-api.com/v4/sports?apiKey=$ODDS_API_KEY" | jq '.[] | {key, title, active}'

Common sport keys:

• americanfootball_nfl - NFL
• basketball_nba - NBA
• baseball_mlb - MLB
• icehockey_nhl - NHL
• soccer_epl - English Premier League
• soccer_usa_mls - MLS

Get Odds

Get current odds for a sport (NFL example):

curl -s "https://api.the-odds-api.com/v4/sports/americanfootball_nfl/odds?apiKey=$ODDS_API_KEY&regions=us&markets=h2h,spreads,totals" | jq '.'

Compact odds view:

curl -s "https://api.the-odds-api.com/v4/sports/americanfootball_nfl/odds?apiKey=$ODDS_API_KEY&regions=us&markets=h2h" | jq '.[] | {game: "\(.home_team) vs \(.away_team)", commence: .commence_time, bookmakers: [.bookmakers[] | {name: .title, odds: .markets[0].outcomes}]}'

Compare spreads across books:

curl -s "https://api.the-odds-api.com/v4/sports/basketball_nba/odds?apiKey=$ODDS_API_KEY&regions=us&markets=spreads" | jq '.[] | {matchup: "\(.away_team) @ \(.home_team)", books: [.bookmakers[] | {book: .title, spread: .markets[0].outcomes[0]}]}'

Markets

• h2h - Moneyline (head-to-head)
• spreads - Point spreads
• totals - Over/under totals

Regions

• us - US sportsbooks (DraftKings, FanDuel, BetMGM, etc.)
• uk - UK bookmakers
• eu - European bookmakers
• au - Australian bookmakers

Best Line Finder

Find the best available line for a game:

# Get best moneyline odds
curl -s "https://api.the-odds-api.com/v4/sports/basketball_nba/odds?apiKey=$ODDS_API_KEY&regions=us&markets=h2h" | jq '
  .[] | 
  {
    game: "\(.away_team) @ \(.home_team)",
    best_home: (.bookmakers | map(.markets[0].outcomes[] | select(.name == .home_team)) | max_by(.price)),
    best_away: (.bookmakers | map(.markets[0].outcomes[] | select(.name == .away_team)) | max_by(.price))
  }
'

Check API Usage

curl -s "https://api.the-odds-api.com/v4/sports?apiKey=$ODDS_API_KEY" -D - 2>&1 | grep -i "x-requests"

Headers show: x-requests-used and x-requests-remaining

Tips

• Cache responses to save API calls
• Use oddsFormat=american or oddsFormat=decimal parameter
• Free tier: 500 requests/month, paid plans available for more