Polymarket Football Odds

• Outcome: Pass
• Latest audit: May 29, 2026, 4:58 AM
• Version:
  0.1.0

Overview

This skill transparently analyzes a user-provided Polymarket soccer link using Polymarket public data and an API-Football key, with no evidence of hidden persistence, broad data access, or exfiltration.

Before installing, understand that this skill sends the Polymarket slug you provide to Polymarket's public Gamma API and sends fixture/team lookup requests plus your API-Football key to API-Football. Use a dedicated API key with quota limits if possible, and treat the output as third-party model predictions rather than betting advice.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation indicates use of environment variables and outbound network access, but it does not declare those permissions explicitly. Hidden or undeclared capabilities reduce transparency for reviewers and users, making it easier for a skill to access secrets such as API keys and send data off-platform without clear authorization boundaries.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The documented purpose does not fully match the actual behavior: it reaches out to Polymarket Gamma directly, relies on API-Football prediction outputs rather than calculating probabilities itself, and exposes additional operational modes. This mismatch can mislead users and security reviewers about what external services are contacted and what data processing occurs, increasing the risk of unauthorized data flow or unsafe trust assumptions.

VirusTotal

65/65 vendors flagged this skill as clean.