Football Prediction Optimized

PassAudited by ClawScan on May 10, 2026.

Overview

This skill appears to perform the disclosed football-prediction task, with the main user-notice items being DeepSeek API-key use and sending selected match data to an external model.

Before installing or running, confirm you trust the DeepSeek endpoint, keep your API key protected, avoid putting private data in input files, and treat the football predictions as informational rather than certain betting advice.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Running the skill requires exposing a DeepSeek API key to this script and the configured API endpoint.

Why it was flagged

The skill requires a DeepSeek API key. This is disclosed and purpose-aligned, but it is a sensitive credential and the registry requirements list no required env vars or primary credential.

Skill content

`DEEPSEEK_API_KEY`: DeepSeek API密钥（必需）

Recommendation

Use a dedicated key if possible, keep it out of logs and shared files, and only use a trusted DEEPSEEK_BASE_URL.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Any text placed in the input file may be transmitted to the external model provider.

Why it was flagged

The script sends prompt messages, including user-provided match feature text, to the configured DeepSeek-compatible chat completions endpoint.

Skill content

payload = {"model": model, "messages": messages, ...}; response = self.session.post(url, json=payload, timeout=60)

Recommendation

Do not include secrets, personal data, or unrelated private information in match feature files; review the provider's data handling terms.

Low

#ASI01: Agent Goal Hijack

What this means

A malicious or malformed match text file could cause inaccurate screening or predictions.

Why it was flagged

Raw feature text is interpolated directly into model prompts. If that text comes from an untrusted source and contains instruction-like content, it could skew the model's JSON prediction output.

Skill content

STAGE1_USER_PROMPT_TEMPLATE.format(fet_txt_batch=fet_txt_batch); STAGE2_PROMPT_TEMPLATE.format(fet_txt=fet_txt)

Recommendation

Use trusted data sources, keep match data clearly delimited, and review predictions before acting on them.