ClawHub
Back to skill

Security audit

Lota Football

Security checks across malware telemetry and agentic risk

Overview

The skill appears to perform its stated football-data function, but it sends an optional API key over plain HTTP by default, so users should review it before use.

Install only if you are comfortable with this Lota API integration. Before setting LOTA_API_KEY, prefer overriding LOTA_API_BASE_URL to an HTTPS endpoint if the service supports it, avoid putting long-lived keys in shared crontabs, and expect the optional scheduled script to write match/report cache files locally.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The script defaults to an unsecured HTTP endpoint for API requests, which exposes all traffic to interception and tampering by any attacker on the network path. Because the script may send an API key in the X-API-Key header and consume remote response data, a man-in-the-middle could steal credentials, alter returned betting/report data, or redirect users to malicious content without any warning.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.