ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Prediction Bridge Skill

v1.0.0

Query live prediction market data from the Prediction Bridge API. Use when the user asks about prediction markets, event odds, market prices, whale trades, trader analytics, or news related to prediction markets. Provides semantic search across 9+ platforms (Polymarket, Kalshi, Limitless, Probable, PredictFun, SxBet, Myriad, PancakeSwap), on-chain whale trade monitoring, Smart PnL analytics, and trader leaderboards. Run the bundled Python script to fetch real-time data.

⭐ 2· 676·0 current·0 all-time
by@kimcheese888
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description match the bundled CLI Python client. The code implements the commands described (search, events, whale-trades, analytics, etc.) and only makes HTTP requests to the configured API; there are no unrelated capabilities (no cloud SDKs, no database or OS-level access).
ℹ
Instruction Scope
SKILL.md instructs running the included Python script; the script uses only stdlib and issues GET/POST requests to the API. It does not read arbitrary local files or request other environment variables beyond an optional PREDICTION_BRIDGE_URL. Note: user queries, wallet addresses, and market IDs supplied to the CLI will be transmitted to the remote API.
✓
Install Mechanism
There is no install spec — instruction-only with an included script. No archives or remote installers are fetched during install. Risk from install mechanism is low.
✓
Credentials
The skill does not require credentials or special environment variables; only an optional PREDICTION_BRIDGE_URL override is documented. No unexpected secrets or unrelated env vars are requested.
✓
Persistence & Privilege
always is false and the skill does not attempt to modify other skills or system configs. The skill can be invoked autonomously by the agent (platform default) which will cause network calls if used — this is normal but worth noting.
Assessment
This skill appears internally consistent: the script does what the README says and does not ask for credentials. However the default API host (prediction-bridge.onrender.com) and the skill owner are unverified (no homepage). Before installing or using it with sensitive input: (1) review the full script (it is included) and confirm you are comfortable with network calls to the default endpoint, (2) do not submit private keys, passwords, or other secrets through the CLI, (3) if you want more assurance, run the script against a self-hosted/trusted proxy by setting PREDICTION_BRIDGE_URL to a vetted endpoint or run it in a sandbox, and (4) prefer skills with a named publisher and homepage for production use.

Like a lobster shell, security has layers — review code before you run it.

latestvk977rzytcqnbg67b70gfamxj3s8115s2

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments