World Cup Predictor

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:44 AM UTC
• Version: 1.0.8

Overview

This skill is a disclosed football-analysis workflow that uses public match and odds sources as evidence, without installing code, taking actions, or handling credentials.

Install only if you want an agent to browse public football, odds, and match-data sources for informational analysis. Treat its predictions as uncertain and not betting advice, and be aware that its default market URLs use Chinese-localized pages unless adjusted by the agent or user.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

Detailed routes and templates live in `references/prediction-framework.md`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md

Detailed routes and templates live in `references/prediction-framework.md`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md

Detailed routes and templates live in `references/prediction-framework.md`.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The invocation description is broad enough to trigger on a wide range of generic football-analysis requests, increasing the chance this skill activates when a narrower or more appropriate skill should handle the task. Over-broad routing can cause unnecessary browsing to betting/market sites and produce domain-specific behavior outside the user's intended scope, which is a real security and safety concern in agent systems even without malicious content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions direct the agent to open /zh/ Polymarket and Stake pages, which imposes a specific locale choice in the skill behavior. There is no language-selection step, user opt-in, or explanation that Chinese localization is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Persistent Context Injection

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.

Content

Scanner excerpt · references/prediction-framework.md (reported line 17)May include surrounding context.

md

| Market baseline | 15% | Polymarket, Stake, books, liquidity, line movement |
| Match-state/context/environment | 15% | group standings or knockout bracket, draw value, advancement path, host boost, heat, travel, governance and continuity signals |

Raise player availability above 25% when a team depends on one or two key roles: a build-up organizer, main ball progressor, primary chance creator, defensive organizer, goalkeeper, set-piece specialist, or main finisher. Use named players only as verified, tournament-specific examples; do not treat them as permanent rules. Availability means role fitness, expected minutes, and replacement quality, not just whether the player appears in the squad.

For knockout matches, raise the style-matchup weight when a favorite has not proven it can create high-quality chances against compact blocks. Paper strength, ranking, and possession become weaker inputs if the team lacks a clear box-occupation plan, reliable striker profile, second-ball pressure, or a bench route to change the rhythm after 70 minutes.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The framework hard-codes zh locale URLs for Polymarket and Stake in its default instructions, which steers use toward a specific language/locale without offering a user choice. This is a natural-language policy issue because the file presents the Chinese-localized pages as the default path rather than documenting an optional or region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instructions require use of Chinese interface labels such as 获胜盘, 让分盘, and 总分盘 as if they are the standard interface, but do not provide English or locale-agnostic alternatives. This can improperly force a specific language environment on users or agents who did not opt into that locale.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/prediction-framework.md (reported line 302)May include surrounding context.

md

- Separate 90-minute prediction from advancement prediction. A team can be more likely to advance without being clearly likely to win in regulation.
- Keep decision-stage probabilities unambiguous: `reach extra time` includes matches later settled in extra time or on penalties, while `decided in extra time` and `reach penalties` are separate branches. If outputting mutually exclusive stages, label them as `90-minute decision / extra-time decision / shootout decision`.
- For finals, use recent final-specific extra-time frequency only as a bounded context prior alongside current 90-minute draw prices, styles, goalkeeper quality, and attacking intent. Do not let a small historical sample override the current matchup, but do not apply a generic knockout-stage prior without checking the final-specific pattern.
- Do not apply group-stage third-place, goal-difference, or "draw is enough" logic to knockout matches. A draw after 90 minutes means extra time and possibly penalties, not a final table outcome.
- Weak or near-peer teams may rationally aim to reach extra time or penalties if their open-play chance creation is limited but their goalkeeper, penalty takers, defensive block, or fatigue profile is competitive.
- Favorites may avoid high-risk chasing while level, especially early, but should become more aggressive if extra time hurts them more than the opponent or if their bench can change chance creation.