Security audit

Lota Football

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its football-data purpose, but it handles API credentials unsafely by default and suggests storing a key in a persistent cron command.

Review before installing. Use this only if you are comfortable sending match queries and an API key to the Lota service. Set LOTA_API_BASE_URL to an HTTPS endpoint before using a real key, avoid putting the key directly in crontab, and remove any scheduled job when you no longer need automatic cache refresh.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: lota_compact_fet.sh:8
Finding: API Credentials Transmitted over Plaintext HTTP
Content: View full analysis
Vulnerability Details

File Locations:

lota_compact_fet.sh:8, 32-38

lota_fetch_future_24h.sh:16, 141-146

lota_football_matches.sh:8, 49-51

Vulnerability Type: Cleartext transmission of API credentials
Risk Level: High

Vulnerable Code

lota_compact_fet.sh:

bash
BASE_URL="${LOTA_API_BASE_URL:-http://deepdata.lota.tv/predictions/api/v2}"

bash
local url="${BASE_URL}/compact-fet/?lota_id=${lota_id}" local curl_cmd=("curl" "-s" "--connect-timeout" "30" "--max-time" "60") if [[ -n "${API_KEY}" ]]; then curl_cmd+=("-H" "X-API-Key: ${API_KEY}") fi curl_cmd+=("${url}")

lota_fetch_future_24h.sh:

bash
BASE_URL="${LOTA_API_BASE_URL:-http://deepdata.lota.tv/predictions/api/v2}"

bash
local curl_cmd=(curl -s --connect-timeout 30 --max-time 60) [[ -n "$API_KEY" ]] && curl_cmd+=(-H "X-API-Key: $API_KEY") local response response=$("${curl_cmd[@]}" "$url")

lota_football_matches.sh:

bash
BASE_URL="${LOTA_API_BASE_URL:-http://deepdata.lota.tv/predictions/api/v2}"

bash
local curl_cmd=("curl" "-s" "--connect-timeout" "30" "--max-time" "60") [[ -n "${API_KEY}" ]] && curl_cmd+=("-H" "X-API-Key: ${API_KEY}") curl_cmd+=("${url}")

Technical Analysis

All three API clients use http://deepdata.lota.tv as their default endpoint and send LOTA_API_KEY in the X-API-Key request header. HTTP provides neither transport encryption nor server authentication. Consequently, any party able to observe or manipulate the network path can read the API key, modify requests, or replace API responses.

Network access and API authentication are legitimate requirements of the Skill. Transmitting the credential over plaintext HTTP is not necessary for that functionality and violates least-privilege and secure-transport principles.

The optional LOTA_API_BASE_URL variable can also redirect authenticated requests t ...[truncated 1382 chars]
Remediation: View remediation
Remediation Suggestions

Change the default endpoint to HTTPS:

bash
BASE_URL="${LOTA_API_BASE_URL:-https://deepdata.lota.tv/predictions/api/v2}"

Reject non-HTTPS endpoints before attaching an API key:

bash
if [[ -n "$API_KEY" && "$BASE_URL" != https://* ]]; then echo "Error: authenticated API requests require HTTPS" >&2 exit 1 fi

If plaintext endpoints are required for isolated development, require an explicit unsafe-development flag and never transmit production credentials in that mode.

Preserve normal TLS certificate and hostname verification. Do not add curl --insecure.

Add robust HTTP failure handling, such as:

bash
curl --fail --show-error --silent \ --connect-timeout 30 --max-time 60 \ -H "X-API-Key: $API_KEY" "$url"

Document that changing LOTA_API_BASE_URL changes the recipient of the API key.

Rotate any API key that may already have been transmitted over an untrusted plaintext connection.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:197
Finding: Long-Lived API Key Embedded Directly in Persistent Cron Configuration
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:197-205
Vulnerability Type: Persistent plaintext secret storage
Risk Level: Medium

Vulnerable Code

bash
crontab -e

bash
*/15 * * * * export LOTA_API_KEY="your_api_key_here" && cd /path/to/skills/lota_football && bash lota_fetch_future_24h.sh >> /path/to/lota_data/cron.log 2>&1

Technical Analysis

The documentation instructs users to replace the placeholder with an API key and store it directly in a crontab entry. This creates a persistent plaintext copy of a long-lived credential in scheduler configuration.

The cron job itself is optional, clearly documented, and relevant to the declared cache-refresh functionality. The scripts do not automatically install it, so the behavior is not a covert backdoor or unauthorized system-persistence mechanism. Nevertheless, embedding the key in scheduler configuration unnecessarily increases exposure through crontab inspection, administrative diagnostics, system backups, configuration exports, and accidental sharing.

Periodic execution is reasonable for the Skill's stated functionality, but persistent inline storage of the credential is not the minimum exposure necessary to implement it.

Attack Path

A user opens the crontab as instructed.

The user replaces your_api_key_here with a valid key.

The scheduler stores the resulting command persistently.

A local administrator, a process with permission to inspect scheduler configuration, a compromised backup, or an accidentally shared diagnostic report obtains the crontab contents.

The exposed key is reused to access the API or consume the user's quota.

Impact Assessment

This issue does not itself elevate privileges or grant access beyond the affected API credential. Its impact includes:

Persistent disclosure of the Lota API key.

Unauthorized API requests under the user's account.

Exhaustio ...[truncated 383 chars]
Remediation: View remediation
Remediation Suggestions

Do not place the API key directly in the crontab command.

Store the credential in a dedicated file readable only by the owning user:

bash
install -m 600 /dev/null "$HOME/.config/lota-football/env"

The protected file may contain:

bash
LOTA_API_KEY="replace_with_real_key"

Use a permission-restricted wrapper script to load the credential and execute the fetcher. Ensure the wrapper and environment file are owned by the intended user and are not writable by other accounts.

Prefer an operating-system credential store or service manager credential facility where available.

Keep the crontab entry free of secrets and point it only to the protected wrapper.

Document how to remove the scheduled task, revoke the API key, and rotate a key after suspected disclosure.

Ensure cron logs do not print environment variables, authorization headers, or full commands containing secrets.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: 描述声称该技能可查询足球比赛列表、查看单场特征报告、免费访问世界杯历史比赛，并包含一套 AI Agent 投注分析提示词框架。但实际代码仅实现了：基于传入的 lota_id 请求远程 compact-fet 接口，并将返回结果原样或部分字段输出。代码中没有比赛列表接口调用、没有任何世界杯历史数据专用逻辑、没有内置提示词或分析框架内容。虽然“单场特征报告”这一点与实际行为部分一致，但整体描述显著超出了代码能力，且遗漏了其通过外部 API/可选 API Key 获取数据这一关键实现行为，因此应判定为描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description presents a user-facing capability to query football match lists, single-match feature reports, historical World Cup matches, and AI betting-analysis prompts. The supplied code does something materially different: it is an automated data collection script for the next 24 hours of matches, using an API key to fetch match lists and compact feature data, saving them into local files, and maintaining update timestamps for periodic refresh. It does not implement historical World Cup retrieval, does not expose querying behavior, and does not include any AI prompt templates or betting-analysis framework. The primary purpose and capabilities therefore do not accurately match the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description partially matches the code in that the script does query football match lists and can fetch a single match by lota_id. However, several declared capabilities are not represented in the code. The script explicitly labels itself as '纯列表，无特征报告' and only calls the /matches/ endpoint with filters like date, lota_id, is_jingcai, is_beidan, start_date, and end_date. There is no endpoint or processing related to feature reports, no World Cup-specific historical dataset access, and no embedded betting-analysis prompt templates, decision frameworks, or output formatting guidance beyond JSON/raw/file output. This is a material description-behavior mismatch because important advertised features are absent and the actual primary behavior is narrower than declared.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.
md
sh` 仅依赖 `curl`（`jq` 为可选，有则格式化输出），跨平台兼容（Linux / macOS / Windows Git Bash / WSL）。`lota_fetch_future_24h.sh` 需要 `curl` + `jq` + `bc` + `awk`。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
md
sh` 仅依赖 `curl`（`jq` 为可选，有则格式化输出），跨平台兼容（Linux / macOS / Windows Git Bash / WSL）。`lota_fetch_future_24h.sh` 需要 `curl` + `jq` + `bc` + `awk`。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.
md
sh` 仅依赖 `curl`（`jq` 为可选，有则格式化输出），跨平台兼容（Linux / macOS / Windows Git Bash / WSL）。`lota_fetch_future_24h.sh` 需要 `curl` + `jq` + `bc` + `awk`。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.
md
sh` 仅依赖 `curl`（`jq` 为可选，有则格式化输出），跨平台兼容（Linux / macOS / Windows Git Bash / WSL）。`lota_fetch_future_24h.sh` 需要 `curl` + `jq` + `bc` + `awk`。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.
md
sh` 仅依赖 `curl`（`jq` 为可选，有则格式化输出），跨平台兼容（Linux / macOS / Windows Git Bash / WSL）。`lota_fetch_future_24h.sh` 需要 `curl` + `jq` + `bc` + `awk`。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.
md
sh` 仅依赖 `curl`（`jq` 为可选，有则格式化输出），跨平台兼容（Linux / macOS / Windows Git Bash / WSL）。`lota_fetch_future_24h.sh` 需要 `curl` + `jq` + `bc` + `awk`。

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to run bash scripts and access networked APIs, yet it declares no permissions or allowed-tools scope. That creates an over-privileged integration risk: an agent/runtime may permit broader shell execution than intended, increasing the blast radius if the skill is misused or its inputs are adversarial.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs use of an API key and repeated remote requests but provides no privacy or data-transmission warning. Users may unknowingly send match queries, identifiers, and authentication data to an external service, which is risky in agent environments where tool use can be automatic and opaque.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: The skill encourages persistent scheduled execution through crontab, causing repeated background network activity and ongoing local data retention. In an agent/tooling context, persistence increases the chance of unintended long-term operation, stale jobs, excess API use, and unnoticed data accumulation beyond a user's immediate request.
Content: Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.
编辑 crontab：

bash
crontab -e

添加以下行（根据你的环境调整路径和密钥）：

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The cron example embeds the API key directly in the command line, which can expose secrets via shell history, process listings, cron configuration files, logs, and support screenshots. Persistent scheduled execution magnifies the risk because the credential may remain recoverable long after initial setup.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script defaults to an insecure HTTP endpoint for API requests, which allows traffic to be intercepted or modified by anyone on the network path. Because the script may send an API key in the X-API-Key header and consumes returned prediction/report data, an attacker could steal credentials or tamper with responses without the user being warned.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file’s user-facing natural language is entirely in Chinese across the header comments, usage text, option descriptions, and runtime/error messages. Per the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest describes a broader skill scope including '单场特征报告' and 'AI Agent 投注分析提示词', but the script's documented commands only support listing matches, fetching a match by lota_id, filtering by betting types, date ranges, and league extraction. No code implements feature-report retrieval or any prompt/template generation for betting analysis, so the actual behavior is materially narrower than the advertised capability.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The inline documentation explicitly states this is a match query tool with 'pure list, no feature report', while the skill manifest says the skill can provide '单场特征报告'. This is an active contradiction between documented intent and declared skill behavior, not merely omitted detail.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Comments, usage text, and error messages are presented in Chinese only, with no indication that another language is available or that the locale restriction is intentional. This can violate a language/locale policy when users are not given an explicit choice or opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The default BASE_URL uses plain HTTP, so API requests and the X-API-Key header can be intercepted or modified by any network attacker in path. That creates a real confidentiality and integrity risk, especially because the script silently performs network requests and may transmit credentials over an insecure channel.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: When --output is provided, the script redirects stdout directly to the specified file using shell redirection. Although this is intentional behavior, there is no confirmation, warning, or help text noting that the file will be written and may overwrite existing contents.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Tp4

Tp4

Tp4

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Undeclared Tool Scope

Missing User Warnings

Session Persistence

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Description-Behavior Mismatch

Intent-Code Divergence

Natural-Language Policy Violations

Missing User Warnings

Missing User Warnings

Static analysis