Yahoo Fantasy Baseball

• Outcome: Pass
• Latest audit: Jul 3, 2026 · 4:11 PM UTC
• Version: 0.1.29

Overview

This skill is a disclosed read-only Yahoo Fantasy Baseball helper, but it requires OAuth credentials, local token storage, network access, and an explicit dependency install.

Install only if you are comfortable running the explicit --setup dependency install, granting Yahoo Fantasy API access, and storing Yahoo OAuth tokens on disk. Treat ~/.openclaw/credentials/yahoo-fantasy/ as sensitive, remove old legacy .env credentials after migration, and expect commands like standouts, standings, scoreboard, draft, and transactions to read league-wide data visible to your Yahoo account.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Install requirements into the venv
    pip_cmd = [_VENV_PYTHON, "-m", "pip", "install", "-q", "-r", _REQUIREMENTS]
    subprocess.check_call(pip_cmd, stdout=sys.stderr, stderr=sys.stderr)

    print("Dependencies installed.", file=sys.stderr)

• Confidence: 90% confidence
• Finding: subprocess.check_call(pip_cmd, stdout=sys.stderr, stderr=sys.stderr)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documentation describes capabilities that access environment variables, write credential and config files, invoke shell commands, and make network requests, yet it declares no permissions. That mismatch is dangerous because users and orchestration systems may treat the skill as lower risk than it actually is, leading to unreviewed credential handling, package installation, and external API access.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence
• Finding: The skill is presented as a read-only fantasy baseball query tool, but the documented behavior also includes interactive OAuth credential collection, persistent local credential storage, creation of a virtual environment, and pip-based dependency installation. Even if the baseball operations are read-only, these additional behaviors materially expand the trust boundary and attack surface, especially around secrets handling and supply-chain risk.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The standouts feature enumerates every team in the league, fetches each roster for a date, and aggregates player performance across the entire league. That exceeds the stated scope of querying the user's own fantasy team/league interactions and may expose other managers' roster usage and benching decisions without explicit disclosure or consent. In a read-oriented fantasy assistant, this is not arbitrary code execution, but it is still a privacy and data-minimization issue because the skill accesses more user-linked league data than the description suggests.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The config command persists league/team/season defaults via save_config(), which is a write operation despite the skill being described as read-only. While this does not modify Yahoo roster state, it does modify local skill state and creates a mismatch between user expectations and actual behavior, which can undermine trust and enable unintended persistence of account-specific metadata.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The documentation states that OAuth consumer secrets and access tokens are written to a persistent file under the user's home directory. Even with 0600 permissions on Unix, storing long-lived credentials on disk increases exposure to local compromise, backups, misconfigured permissions on non-Unix systems, or accidental inclusion in support bundles. In this skill's context, the data is read-only for fantasy league access, so the blast radius is limited but still real for account/session confidentiality.

Credential Access

High

• Category: Privilege Escalation

Content

"consumer_key": consumer_key,
            "consumer_secret": consumer_secret,
        }
        # Carry over tokens if present (YFPY stored them in .env too)
        access_token = creds.get("YAHOO_ACCESS_TOKEN")
        refresh_token = creds.get("YAHOO_REFRESH_TOKEN")
        token_type = creds.get("YAHOO_TOKEN_TYPE")

• Confidence: 73% confidence
• Finding: .env

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.