Sports Odds

PassAudited by ClawScan on May 1, 2026.

Overview

This is a straightforward read-only sports odds lookup skill, but users should notice that it uses an Odds API key and external API requests that can consume quota.

This skill appears safe for its stated purpose. Before installing, make sure you are comfortable providing an Odds API key and allowing the agent to make read-only requests to The Odds API that may count against your monthly quota.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

API calls made through the skill may consume the user's Odds API request quota or paid plan allowance.

Why it was flagged

The skill requires a provider API key to access The Odds API. This is expected for the stated purpose, but it gives the skill access to use the user's API quota.

Skill content

Set the environment variable: `export ODDS_API_KEY=your_key_here`

Recommendation

Use a dedicated, revocable API key where possible, avoid pasting the key into chat, and monitor API usage.

Info

#ASI02: Tool Misuse and Exploitation

What this means

Using the skill sends sports, region, and market queries to The Odds API and may use request quota.

Why it was flagged

The skill uses curl to make external API requests and jq to format the responses. This is central to the skill's purpose and is not shown as hidden or destructive behavior.

Skill content

curl -s "https://api.the-odds-api.com/v4/sports/americanfootball_nfl/odds?apiKey=$ODDS_API_KEY&regions=us&markets=h2h,spreads,totals" | jq '.'

Recommendation

Confirm repeated or broad lookups before running them, and use the provided usage-check command or caching tips to avoid unnecessary quota consumption.