MLB Daily Scores

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a straightforward MLB update skill, but it can install Python packages and optionally create a daily scheduled message to a channel you choose.

This skill looks reasonable for daily MLB updates. Before installing, make sure you trust the skill and its Python dependencies, configure only your team/timezone, and schedule delivery only to channels where you are comfortable receiving automated sports reports.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI05: Unexpected Code Execution

What this means

Installing the skill may run its setup code on your machine to prepare dependencies.

Why it was flagged

The skill metadata describes an install-time hook that changes file modes and runs the local setup script. This is disclosed and consistent with dependency setup, but it is still local code execution during installation.

Skill content

"postInstall": "cd {baseDir} && sed -i 's/\\r$//' *.py *.sh && chmod +x fetch_mlb.py setup.sh && python3 {baseDir}/setup.py"

Recommendation

Install only if you trust the skill source, and review setup.py/setup.sh if you want to verify what runs during setup.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The installed dependencies could change over time unless pinned, so behavior depends partly on external packages.

Why it was flagged

The setup script installs unpinned packages from the Python package ecosystem. This is normal for this kind of integration, but it depends on external package provenance.

Skill content

PACKAGES = ["MLB-StatsAPI", "requests"] ... subprocess.check_call([str(venv_python), "-m", "pip", "install"] + PACKAGES)

Recommendation

Prefer pinned dependency versions or review the packages before installing in sensitive environments.

Low

#ASI10: Rogue Agents

What this means

If configured, the skill will keep running on a schedule and send messages until the cron job is removed or disabled.

Why it was flagged

The skill documents a persistent daily cron job that can post reports to a messaging channel. This is disclosed and fits the stated daily-update purpose.

Skill content

openclaw cron add --name "MLB Daily Scores" --cron "0 6 * * *" ... --announce --channel discord --to "channel:YOUR_CHANNEL_ID"

Recommendation

Set up the cron job only for channels you intend to use, and remove or disable it when you no longer want daily reports.