Ev Calculator

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a straightforward EV calculator, with disclosed paid x402/API use that users should explicitly approve before sending data or payment.

This skill looks safe to use as a calculator based on the provided files. Before installing or invoking the paid API, verify the GitHub source if you use it, confirm any x402 USDC payment yourself, and avoid sending confidential trading assumptions to the external endpoint unless you intend to share them.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

If a user or agent invokes the paid endpoint without careful confirmation, it could spend a small amount of USDC.

Why it was flagged

The skill advertises an on-chain micro-payment flow to a specific wallet. The price and destination are disclosed, but payment authority should remain under explicit user control.

Skill content

auth_type: "x402"
price: "0.01"
currency: "USDC"
chain: "Base"
wallet: "0x24b288c98421d7b447c2d6a6442538d01c5fce22"

Recommendation

Confirm the charge, wallet address, chain, and endpoint before approving any x402 payment.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Private trading assumptions entered for calculations could be sent to a third-party endpoint.

Why it was flagged

The skill declares an external API endpoint for EV calculation. This is disclosed and purpose-aligned, but user-supplied trading assumptions or probabilities may be transmitted to that service if the API path is used.

Skill content

endpoint: "https://kelly-formula-crypto.vercel.app/api/ev"
capabilities:
  - api_call

Recommendation

Use the local script for sensitive calculations, or only send data to the external endpoint when you are comfortable sharing it.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing from a repository outside the reviewed artifact bundle could expose the user to changes not shown here.

Why it was flagged

The README documents optional installation from a GitHub repository. The provided requirements file contains no external dependencies, so this is mainly a provenance verification note.

Skill content

git clone https://github.com/jinboh68-prog/ev-calculator.git
cd ev-calculator
pip install -r requirements.txt

Recommendation

If installing from GitHub, verify the repository and review the exact files or commit before running them.