Ev Calculator

PassAudited by VirusTotal on May 11, 2026.

Overview

Type: OpenClaw Skill Name: ev-calculator Version: 1.0.0 The ev-calculator skill is a legitimate tool for calculating expected value (EV) and Kelly criterion positions for trading and betting. The Python script (scripts/ev_calculator.py) contains standard mathematical logic with no network, file system, or sensitive data access, and the SKILL.md instructions are consistent with the stated purpose of the tool.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

If a user or agent invokes the paid endpoint without careful confirmation, it could spend a small amount of USDC.

Why it was flagged

The skill advertises an on-chain micro-payment flow to a specific wallet. The price and destination are disclosed, but payment authority should remain under explicit user control.

Skill content

auth_type: "x402"
price: "0.01"
currency: "USDC"
chain: "Base"
wallet: "0x24b288c98421d7b447c2d6a6442538d01c5fce22"

Recommendation

Confirm the charge, wallet address, chain, and endpoint before approving any x402 payment.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Private trading assumptions entered for calculations could be sent to a third-party endpoint.

Why it was flagged

The skill declares an external API endpoint for EV calculation. This is disclosed and purpose-aligned, but user-supplied trading assumptions or probabilities may be transmitted to that service if the API path is used.

Skill content

endpoint: "https://kelly-formula-crypto.vercel.app/api/ev"
capabilities:
  - api_call

Recommendation

Use the local script for sensitive calculations, or only send data to the external endpoint when you are comfortable sharing it.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing from a repository outside the reviewed artifact bundle could expose the user to changes not shown here.

Why it was flagged

The README documents optional installation from a GitHub repository. The provided requirements file contains no external dependencies, so this is mainly a provenance verification note.

Skill content

git clone https://github.com/jinboh68-prog/ev-calculator.git
cd ev-calculator
pip install -r requirements.txt

Recommendation

If installing from GitHub, verify the repository and review the exact files or commit before running them.