Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
AC Milan Match Monitor
v1.2.1Check if AC Milan played yesterday and send the result. Uses ESPN public API — no token, no region restrictions. Works with curl directly. Silent if no match...
⭐ 1· 58·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description (check yesterday's AC Milan match via ESPN) matches the included scripts and schedule.json. However, the package metadata states "Required binaries: none" and SKILL.md says "No dependencies beyond Python 3 stdlib", yet both scripts call /usr/bin/curl via subprocess. Requesting network access to ESPN/Google/YouTube is consistent with the stated purpose, but the missing declaration of curl is an incoherence.
Instruction Scope
SKILL.md instructions are narrowly scoped: run scripts in the skill folder, read local schedule.json, call ESPN API, build a YouTube search URL, fetch Google News RSS, and print results. The provided cron payload and behavior (silent when no match) are explicit. The runtime instructions do not ask the agent to read unrelated files, environment variables, or credentials.
Install Mechanism
There is no install spec (instruction-only skill) and the code files are included. Nothing is downloaded from external URLs or written outside the skill directory except schedule.json (which the update script intentionally updates). This is low-risk from an install-source perspective.
Credentials
The skill declares no required environment variables or credentials and the code does not read environment secrets. It only makes outbound requests to ESPN, Google News RSS, and creates YouTube search URLs — consistent with its purpose. Note: making network requests can reveal the host IP to those external services (expected behavior).
Persistence & Privilege
always is false and the skill does not modify other skills or system-wide agent settings. The update_schedule.py writes/overwrites schedule.json inside its own skill folder only, which is expected for its purpose.
What to consider before installing
This skill appears to do what it says: read a local schedule, query ESPN for yesterday's result, construct YouTube search links and fetch a Google News RSS to include headlines. Before installing, note two practical issues: (1) the scripts call /usr/bin/curl but the metadata and SKILL.md claim no external binaries — ensure curl exists at that path on your host (or modify the scripts to use an available curl or Python requests). (2) The scripts make outbound network calls (ESPN, news.google.com, YouTube URLs) which will expose the runner's IP and contact those services; this is expected but worth knowing. If you plan to allow autonomous invocation, remember the skill will run network requests on schedule (update_schedule writes schedule.json weekly and check_match can be cron-run daily). If you want to be cautious, run the scripts manually in a sandbox or inspect/adjust the code (e.g., change absolute curl path, increase timeouts, or restrict schedule.json writes) before enabling automatic scheduling.Like a lobster shell, security has layers — review code before you run it.
latestvk9738pr0x78rg4mmveyfhhkpsd83gzdk
License
MIT-0
Free to use, modify, and redistribute. No attribution required.