双色球选号系统 v2

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a coherent local lottery-number helper; the main thing to notice is that it may run bundled Python scripts and install unpinned Python packages.

Before installing, be aware that this skill runs local Python scripts and may install external Python dependencies. Use a virtual environment if possible, and treat the lottery outputs as informational only, not as a guaranteed prediction.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill may pull external Python packages into the user's environment.

Why it was flagged

The skill declares installation of third-party Python packages without version pinning; this is disclosed and plausibly related to updating historical data, but it introduces normal package-supply-chain exposure.

Skill content

"python_packages": ["requests", "beautifulsoup4"] ... "command": ["pip3", "install", "-q", "requests", "beautifulsoup4"]

Recommendation

Install in a virtual environment where possible, pin or review dependency versions if reproducibility matters, and confirm the package install is acceptable before use.

Info

#ASI05: Unexpected Code Execution

What this means

Running the skill executes local Python code that can read the included data/config files and write generated result files.

Why it was flagged

The skill's normal workflow runs bundled Python scripts. This is disclosed and central to the skill's purpose, but it means code executes with the user's local permissions.

Skill content

python3 scripts/update_ssq_history.py ... python3 scripts/generate_ssq.py ... python3 scripts/backtest_ssq.py

Recommendation

Run it from the intended skill directory, review configuration before use, and avoid granting unnecessary elevated permissions.