Sports Betting Analyzer

• Outcome: Review
• Latest audit: May 29, 2026 · 9:30 PM UTC
• Version: 1.0.0

Overview

This skill is a betting-analysis tool that gives stake recommendations while relying heavily on simulated or random data, so users should review it carefully before installing.

Install only if you understand this is an MVP/demo-style betting assistant using simulated and random data. Do not treat its predictions, value-bet labels, or stake percentages as reliable betting advice, and check local gambling laws and your own risk limits before using it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The stored report presents a concrete betting-oriented output ('建议投注：1.0%') while the same report states it is not betting advice. In a sports-betting assistant, this contradiction can mislead users into treating the output as actionable wagering guidance despite the disclaimer, increasing legal, compliance, and user-harm risk.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: This report again gives a specific betting figure despite an embedded disclaimer denying that the analysis constitutes betting advice. Repeating this pattern in persisted history normalizes contradictory messaging and may cause users or downstream systems to interpret the skill as an advisory tool.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The third report repeats the same inconsistency: a concrete suggested betting amount is displayed alongside a non-advisory disclaimer. In this domain, users may rely on even low-confidence numerical stake cues, so the contradiction materially increases the chance of harmful reliance.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The code presents itself as a data-driven sports betting analyzer, but a component of the betting recommendation (`value_bet`) is determined randomly rather than from actual data or model output. In a gambling-related context, this can mislead users into placing bets based on fabricated analysis, creating financial harm and undermining trust in the system's outputs.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The inline comment explicitly states the correct method for evaluating a value bet, but the implementation ignores that and returns a random result. This mismatch is dangerous because it gives users false confidence that the recommendation is analytically grounded when it is actually arbitrary, which is especially risky in a betting-assistance tool.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The module is presented as collecting and storing match, odds, and injury data, but it actually fabricates those values with random outputs. In a sports-betting context, this is dangerous because downstream predictions and betting advice may appear data-driven while being based on invented inputs, creating a material risk of deceptive or harmful decision support.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The docstrings and comments describe real-world data collection for statistics, head-to-head records, odds, and injuries, but the implementation generates synthetic values instead. Because this skill is explicitly for betting analysis, the mismatch can mislead users or other components into trusting fabricated evidence as factual, amplifying financial and reputational harm.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The implementation claims to predict total points from offensive and defensive data, but it actually ignores all input features and returns random values. In a sports-betting assistant, presenting random outputs as data-driven predictions can mislead users into making financial decisions based on fabricated analysis.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The over/under function is documented as a prediction method, but it returns essentially random probabilities unrelated to match features. In the context of betting advice, this creates deceptive output that may cause users to trust and act on meaningless recommendations.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The code explicitly generates betting actions such as '推荐投注' and assigns stake percentages, despite positioning the tool as decision support only. In a gambling-related skill, this contradiction can mislead users into treating the output as actionable financial advice, increasing legal, compliance, and user-harm risk.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The disclaimer says the analysis is not betting advice, but elsewhere the report includes a dedicated betting recommendation section with suggested actions and percentages. This inconsistency is dangerous because users may rely on the actionable content while the disclaimer attempts to shift responsibility, which is especially concerning in a sports-betting context.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The example trigger phrases are generic natural-language requests such as asking what games are worth betting on or requesting weekend recommendations, which can easily overlap with ordinary conversation and unintentionally invoke the skill. In a betting context, accidental activation is more sensitive because it can steer users toward gambling-related advice without a clearly intentional opt-in.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal, suspicious.insecure_tls_verification (+1 more)

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/numpy/_core/arrayprint.py:1568

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/numpy/_core/tests/test_arrayprint.py:339

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/numpy/_core/tests/test_dtype.py:1070

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/numpy/_core/tests/test_multiarray.py:1665

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/numpy/_core/tests/test_records.py:170

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/numpy/_core/tests/test_scalarmath.py:618

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/numpy/_core/tests/test_simd.py:244

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/numpy/_core/tests/test_umath_accuracy.py:77

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/numpy/_core/tests/test_umath.py:512

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/numpy/f2py/auxfuncs.py:632

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/numpy/f2py/capi_maps.py:159

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/numpy/f2py/crackfortran.py:1329

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/numpy/random/tests/test_extending.py:111

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/numpy/testing/_private/extbuild.py:78

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/numpy/tests/test_lazyloading.py:26

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/numpy/tests/test_public_api.py:405

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/numpy/typing/tests/test_typing.py:205

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/pip/_vendor/distlib/wheel.py:131

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/pip/_vendor/pygments/formatters/__init__.py:91

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/pip/_vendor/pyparsing/results.py:57

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: venv/lib/python3.12/site-packages/pip/_vendor/typing_extensions.py:1251

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: venv/lib/python3.12/site-packages/pip/_internal/network/auth.py:93

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: venv/lib/python3.12/site-packages/pip/_vendor/requests/adapters.py:214

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: venv/lib/python3.12/site-packages/pip/_vendor/requests/sessions.py:323

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: venv/lib/python3.12/site-packages/pip/_vendor/urllib3/connection.py:423

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: venv/lib/python3.12/site-packages/pip/_vendor/urllib3/connectionpool.py:988

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: venv/lib/python3.12/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.py:231

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: venv/lib/python3.12/site-packages/pip/_vendor/urllib3/contrib/socks.py:102

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: venv/lib/python3.12/site-packages/numpy/_core/multiarray.py:112

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: venv/lib/python3.12/site-packages/numpy/_core/tests/test_overrides.py:294

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: venv/lib/python3.12/site-packages/numpy/lib/_ufunclike_impl.py:16

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: venv/lib/python3.12/site-packages/pip/_internal/network/session.py:304

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: venv/lib/python3.12/site-packages/pip/_vendor/distlib/wheel.py:183

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: venv/lib/python3.12/site-packages/pip/_vendor/truststore/_macos.py:353

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: venv/lib/python3.12/site-packages/pip/_vendor/truststore/_windows.py:443

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: venv/lib/python3.12/site-packages/pip/_vendor/urllib3/connection.py:454

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: venv/lib/python3.12/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.py:113

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: venv/lib/python3.12/site-packages/pip/_vendor/urllib3/contrib/securetransport.py:795

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: venv/lib/python3.12/site-packages/pip/_vendor/urllib3/util/ssl_.py:137

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: venv/lib/python3.12/site-packages/numpy/_core/strings.py:570

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: venv/lib/python3.12/site-packages/numpy/_core/tests/test_arrayprint.py:332

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: venv/lib/python3.12/site-packages/numpy/_core/tests/test_defchararray.py:820

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: venv/lib/python3.12/site-packages/numpy/_core/tests/test_longdouble.py:360

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: venv/lib/python3.12/site-packages/numpy/_core/tests/test_multiarray.py:4628

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: venv/lib/python3.12/site-packages/numpy/_core/tests/test_regression.py:2573

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: venv/lib/python3.12/site-packages/numpy/lib/tests/test_format.py:573

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: venv/lib/python3.12/site-packages/numpy/lib/tests/test_io.py:707

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: venv/lib/python3.12/site-packages/numpy/random/tests/test_generator_mt19937.py:972