ClawHub
Back to skill

Security audit

MLB Daily Scores

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a normal MLB scores notifier, with the main caution that installation automatically downloads unpinned Python packages.

Before installing, be aware that the install hook runs Python setup code and downloads third-party packages from the package index. This is consistent with the skill's purpose, but pinned dependencies or hash-verified installs would be safer.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
setup.py:18
Finding

Automatic Installation of Unpinned Third-Party Dependencies

Content
View full analysis
/dev/null; then echo "Using uv..." uv pip install --python "$VENV_PYTHON" MLB-StatsAPI requests else echo "Using pip..." "$VENV_PYTHON" -m pip install MLB-StatsAPI requests fi ``` The installation is automatically initiated by the post-install hook in `SKILL.md`: ```json5 "hooks": { "postInstall": "cd {baseDir} && sed -i 's/\\r$//' *.py *.sh && chmod +x fetch_mlb.py setup.sh && python3 {baseDir}/setup.py", }, ``` ### Technical Analysis The Skill installs `MLB-StatsAPI` and `requests` from the package index without exact version constraints, a lock file, or package integrity hashes. Dependency resolution therefore selects whichever compatible releases are available at installation time rather than artifacts that were reviewed alongside the Skill. Python packages can execute installation or build-related code during dependency installation. Although the packages are placed in a project-local virtual environment, the package manager and any build subprocesses still run with the privileges of the user installing the Skill. A virtual environment isolates Python package placement; it is not a security sandbox and does not prevent installation-time code from accessing user-readable files or the network. The risk is amplified ...[truncated 2191 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README suggests an on-demand trigger phrased as ordinary natural-language baseball conversation: "What happened in the Yankees game yesterday?" In many assistant environments, that overlap can cause the skill to activate unintentionally during normal chat, leading to surprise execution, unnecessary external API calls, and unintended message delivery behavior. The sports context makes the impact lower than for a privileged system-management skill, but the ambiguity is still a real invocation-safety issue.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill invokes shell commands, reads user configuration, uses a local Python environment, and accesses the network, but it declares no explicit tool scope or permissions. This creates an over-privileged execution model where the agent may run with broader capabilities than necessary, increasing blast radius if the skill is modified, compromised, or mis-invoked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The on-demand trigger phrases are broad natural-language requests like asking what happened in a team's game yesterday, which can overlap with ordinary baseball conversation. That can cause unintended invocation of the skill, resulting in unnecessary command execution, network access, and message delivery without clear user intent.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
## Instructions for the agent

`{baseDir}` in these instructions refers to the directory containing this SKILL.md file. Determine this path from the location of this file (e.g., if this file is at `/home/openclaw/.openclaw/workspace/skills/mlb-daily-scores/skills/mlb-daily-scores/SKILL.md`, then `{baseDir}` is `/home/openclaw/.openclaw/workspace/skills/mlb-daily-scores/skills/mlb-daily-scores`).

When this skill is invoked (via cron, slash command, or user request):

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · setup.py (reported line 28)May include surrounding context.

python
base_dir = Path(__file__).resolve().parent
    venv_dir = base_dir / ".venv"

    # Create virtual environment if it doesn't exist
    if not venv_dir.exists():
        print(f"Creating virtual environment in {venv_dir} ...")
        subprocess.check_call([sys.executable, "-m", "venv", str(venv_dir)])

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · setup.py (reported line 31)May include surrounding context.

python
# Create virtual environment if it doesn't exist
    if not venv_dir.exists():
        print(f"Creating virtual environment in {venv_dir} ...")
        subprocess.check_call([sys.executable, "-m", "venv", str(venv_dir)])

    # Determine the venv's Python and pip paths
    if sys.platform == "win32":

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · setup.py (reported line 49)May include surrounding context.

python
uv = shutil.which("uv")
    if uv:
        print("Using uv...")
        subprocess.check_call(
            [uv, "pip", "install", "--python", str(venv_python)] + PACKAGES
        )
    else:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · setup.py (reported line 54)May include surrounding context.

python
)
    else:
        print(f"Using pip ({venv_python})...")
        subprocess.check_call(
            [str(venv_python), "-m", "pip", "install"] + PACKAGES
        )

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · setup.sh (reported line 13)May include surrounding context.

sh
echo "=== mlb-daily-scores: Installing dependencies ==="

# Create virtual environment if it doesn't exist
if [ ! -d "$VENV_DIR" ]; then
    echo "Creating virtual environment in $VENV_DIR ..."
    python3 -m venv "$VENV_DIR"

Static analysis

No suspicious patterns detected.