Live Sports Scores & News

PassAudited by ClawScan on May 11, 2026.

Overview

This skill appears purpose-aligned: it runs an included Python script to fetch sports scores from disclosed sports APIs, with an optional API-Football key for football-specific results.

Before installing, be comfortable with the skill making outbound requests to TheSportsDB and API-Football. If you use the API-Football features, treat the API key as private and do not ask the agent to print or store it.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent may run the included Python script to contact sports APIs when the user asks for sports information.

Why it was flagged

The skill relies on local command execution, which users should notice, but the commands are narrowly described and tied to sports-score lookups.

Skill content

Tutti i comandi si eseguono con `exec` chiamando lo script Python incluso nella skill

Recommendation

Keep usage to the documented commands and do not allow arbitrary commands or unrelated arguments.

Low

#ASI03: Identity and Privilege Abuse

What this means

Using the football-specific commands consumes the user's API-Football quota and exposes that key to the command invocation path and the API-Football service.

Why it was flagged

For API-Football commands, a user-provided API key is sent to the intended provider as an HTTP header.

Skill content

url = "https://v3.football.api-sports.io/fixtures?live=all"
    data = fetch(url, {"x-apisports-key": api_key})

Recommendation

Only provide an API-Football key you are comfortable using with this skill, avoid sharing it in final responses, and revoke or rotate it if it is accidentally exposed.