CPBL
v1.4.2Query CPBL 中華職棒 scores schedules live games standings player stats news and Taiwan baseball history for Taiwan users Use when the user asks about CPBL 戰績 賽程...
⭐ 0· 196·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the included code: all scripts target CPBL endpoints and a Taiwan baseball wiki for historical facts. Required env/config/credentials are none and the code's network activity is consistent with the stated purpose.
Instruction Scope
SKILL.md correctly instructs using bundled scripts and web_search/web_fetch for news and wiki pages. It also suggests checking a memory cache file (memory/cpbl_schedule_YYYY.md) and to fall back to the wiki when the official site lacks historical data — this grants the agent discretion to read a memory file path that is not declared in requires.config and to fetch external websites (expected for this skill).
Install Mechanism
There is no install spec even though the scripts declare Python requirements (requires-python >=3.11, dependency scrapling[ai]) in file headers. The bundle includes runnable Python scripts but does not provide automated installation steps; the runtime will need scrapling and a suitable Python environment (and a headless browser for DynamicFetcher). This mismatch may cause runtime failures if the host environment lacks these dependencies.
Credentials
The skill requests no environment variables or credentials. It does persist a CSRF token to a temp file (TOKEN_CACHE_FILE in the system temp directory) for reuse; this is proportional to needing to call CSRF-protected AJAX endpoints but is worth noting since the file is stored on disk in a global temp location.
Persistence & Privilege
always:false and default autonomous invocation are used (normal). The only persistent artifact is a token cache file written to the system temporary directory (cpbl_csrf_token.txt). That is limited scope (CSRF token only) and not a system-wide configuration change, but the token cache is stored in a world-readable temp location by default which could be accessible to other local users/processes.
Assessment
This skill is coherent with its stated purpose and does not ask for secrets, but note the following before installing:
- The package contains Python scripts that require Python >=3.11 and scrapling[ai] (a headless-browser-capable fetcher). There is no automated install spec — ensure your runtime has these dependencies (and a suitable headless browser environment) or the scripts will fail.
- The skill caches a CSRF token to a temp file (e.g., /tmp/cpbl_csrf_token.txt). This is used to avoid re-fetching tokens and is expected, but the cached file could be readable by other local users on the same machine. If that is a concern, run in a restricted environment or modify the code to store the cache in a private location.
- The SKILL.md instructs the agent to read memory/cpbl_schedule_YYYY.md and to use web_search/web_fetch for news/wiki pages. That means the agent may read a local memory file (not declared in requires.config) and make outbound network requests to cpbl.com.tw and twbsball.dils.tku.edu.tw. Ensure you trust the skill and accept outbound network activity.
- Because the skill uses dynamic fetching (scrapling.DynamicFetcher), it will instantiate headless-browser activity which can be heavier and require additional runtime privileges/resources.
If you accept these points, the skill looks internally consistent and appropriate for CPBL queries. If you want a stricter environment, request an install spec or run the scripts in a sandboxed environment first.Like a lobster shell, security has layers — review code before you run it.
baseballvk97bbghtxmbba0ywj5x48w5m6n844tm5cpblvk97bbghtxmbba0ywj5x48w5m6n844tm5latestvk975fp5750drxgxk99v4b6fn39846hdnscoresvk97bbghtxmbba0ywj5x48w5m6n844tm5sportsvk97bbghtxmbba0ywj5x48w5m6n844tm5taiwanvk97bbghtxmbba0ywj5x48w5m6n844tm5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.