Back to skill
Skillv1.0.0
ClawScan security
Rich Lottery · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 15, 2026, 8:25 AM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, instructions, and declared requirements are consistent with a paid lottery-number recommendation API; nothing in the package indicates covert data exfiltration or unrelated credential access.
- Guidance
- This package appears coherent: it is a small paid API that returns randomly-generated recommendations using an included analysis script. Before installing or paying, confirm how the x402 payment is validated (the server currently only checks for the presence of an 'x402' header, which may be a superficial check unless the payment system is enforced elsewhere). If you intend to deploy the code yourself, note vercel.json and requirements.txt will cause pip to install Flask. The skill does not request secrets, but you should verify any real payment flow, and avoid sending sensitive personal data to the external endpoint (https://rich-lottery.vercel.app) since calls to that URL would leave your environment.
Review Dimensions
- Purpose & Capability
- okName/description (lottery number recommendations) match the provided code and SKILL.md. The package includes a small Flask app and a local analysis script that generate recommendations; the payment metadata (price, wallet, chain) appears aligned with the stated x402 paywall.
- Instruction Scope
- noteSKILL.md instructs callers to curl the listed endpoints. The server enforces payment by requiring an 'x402' header for /ssq and /dlt; SKILL.md declares the x402 payment but does not show how the header is obtained/constructed. The runtime instructions do not read unrelated files or secrets. The app uses subprocess to run a bundled local script (expected for this package) — no user-supplied inputs are passed into the subprocess invocation.
- Install Mechanism
- noteRegistry metadata said 'instruction-only' but the package includes code, requirements.txt, and vercel.json (build/install commands). There is no download-from-arbitrary-URL behavior; deployment would install Flask from PyPI (requirements.txt). This is low risk but the presence of deploy config despite 'instruction-only' is an internal inconsistency to be aware of.
- Credentials
- okNo environment variables, credentials, or config paths are required. The code includes a hard-coded recipient wallet and price, which matches SKILL.md. There is no request for unrelated secrets or system credentials.
- Persistence & Privilege
- okSkill is not marked always:true, does not request persistent system privileges, and does not modify other skills. The service runs as a normal web endpoint and the included Flask app is self-contained.