ClawHub
Back to skill

Security audit

sports-ticker

Security checks for vulnerabilities and agentic risk

Overview

The skill provides sports alerts, but it also uses under-disclosed third-party search services and can read an API key from another installed skill, so it needs review before installation.

Install only if you are comfortable with this skill contacting ESPN plus Brave or Serper, storing local score/state files, and generating automations. Before using it, remove the web-search-plus .env fallbacks or require a sports-ticker-specific key, and review any generated automations before applying them.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/ticker.py:22
Finding

Undeclared Cross-Skill Credential Access in Ticker Web-Search Fallback

Content
View full analysis

Vulnerability Details

File Location: scripts/ticker.py, lines 22-34 and 72-81
Vulnerability Type: Cross-skill credential access and unauthorized credential use
Risk Level: Medium

Vulnerable Code

python
def _load_key(env_var: str, env_file_key: str) -> str:
    """Load API key from env or web-search-plus .env file."""
    key = os.environ.get(env_var, "")
    if not key:
        env_paths = [
            Path(__file__).parent.parent.parent / "web-search-plus" / ".env",
            Path(os.environ.get("HOME", "/root")) / "clawd/skills/web-search-plus/.env",
        ]
        for ep in env_paths:
            if ep.exists():
                for line in ep.read_text().splitlines():
                    if env_file_key in line and "=" in line:
                        key = line.split("=", 1)[-1].strip().strip("'\"").lstrip("export ")
                        break
    return key

The recovered credential is subsequently used in an outbound request:

python
# 2. Serper fallback
serper_key = _load_key("SERPER_API_KEY", "SERPER_API_KEY")
if serper_key:
    try:
        payload = json.dumps({"q": query, "num": 3}).encode()
        req = urllib.request.Request(
            "https://google.serper.dev/search",
            data=payload,
            headers={"X-API-KEY": serper_key, "Content-Type": "application/json"},
        )
        data = json.loads(urllib.request.urlopen(req, timeout=10).read())

Technical Analysis

The Skill declares that no API keys are needed and identifies ESPN as its scoring service. Nevertheless, when ESPN does not return a match, ticker.py searches for and reads a .env file belonging to the separate web-search-plus Skill.

This crosses the expected isolation boundary between Skills. Possession of filesystem access to sibling Skill directories should not be interpreted as authorization to consume their credentials. The behavior i ...[truncated 2482 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove both hard-coded paths to web-search-plus/.env. A Skill must not discover or read credentials owned by sibling Skills.

  2. Accept SERPER_API_KEY only through an explicitly scoped process environment variable or a sports-ticker-specific secret store.

  3. Make web search an explicit, disabled-by-default configuration option, such as:

    json
    {
  "web_search_fallback": {
    "enabled": false,
    "provider": "serper"
  }
}

  4. Inform the user during setup that enabling this option sends team names and dates to the selected search provider.

  5. Update SKILL.md, README.md, and OpenClaw metadata to accurately declare optional Brave and Serper network access and associated secret requirements.

  6. Prefer the existing local cache fallback when no explicitly authorized search credential is available.

  7. If .env support is retained for standalone operation, restrict it to a Skill-owned file, apply restrictive permissions, and parse exact variable names using a dedicated parser rather than substring matching.

  8. Add tests confirming that sports-ticker never reads files outside its own project directory.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/live_monitor.py:64
Finding

Scheduled Live Monitor Reuses a Sibling Skill's Serper Credential

Content
View full analysis

Vulnerability Details

File Location: scripts/live_monitor.py, lines 64-87
Vulnerability Type: Cross-skill credential access in an automation-compatible execution path
Risk Level: Medium

Vulnerable Code

python
def _try_serper(query: str) -> str:
    # Load key from env or web-search-plus .env
    serper_key = os.environ.get("SERPER_API_KEY", "")
    if not serper_key:
        env_paths = [
            Path(__file__).parent.parent.parent / "web-search-plus" / ".env",
            Path(os.environ.get("HOME", "/root")) / "clawd/skills/web-search-plus/.env",
        ]
        for ep in env_paths:
            if ep.exists():
                for line in ep.read_text().splitlines():
                    if "SERPER_API_KEY" in line and "=" in line:
                        serper_key = line.split("=", 1)[-1].strip().strip("'\"")
                        break
    if not serper_key:
        return ""
    try:
        import json as _json
        payload = _json.dumps({"q": query, "num": 3}).encode()
        req = urllib.request.Request(
            "https://google.serper.dev/search",
            data=payload,
            headers={"X-API-KEY": serper_key, "Content-Type": "application/json"},
        )
        data = _json.loads(urllib.request.urlopen(req, timeout=10).read())

Technical Analysis

live_monitor.py duplicates the unauthorized cross-Skill credential discovery implemented by ticker.py. If a team lacks an ESPN ID, _web_search_live() invokes Brave or Serper search. When SERPER_API_KEY is absent from the process environment, _try_serper() reads the credential from the separate web-search-plus Skill.

This path is particularly significant because the project is designed to run live_monitor.py through persistent OpenClaw automations, potentially every two minutes during match windows. Although the automation-generation scripts only output configurations and ...[truncated 2284 chars]

Remediation
View remediation

Remediation Suggestions

  1. Delete all references to sibling web-search-plus/.env paths.
  2. Require a sports-ticker-scoped credential supplied through an approved secret mechanism.
  3. Disable search-provider fallback by default and require explicit opt-in before automation configurations are generated.
  4. Include the selected external providers, expected data fields, polling frequency, and potential quota consumption in the setup confirmation.
  5. Ensure generated automation payloads use ESPN-only monitoring unless the user has separately authorized web search.
  6. Add rate limits and a maximum request budget for scheduled web-search fallback.
  7. Log a concise, non-secret warning when a fallback provider is unavailable instead of suppressing all exceptions.
  8. Never log or print API-key values.
  9. Document that team names are sent to Brave or Serper when the optional fallback is enabled.
  10. Add automated tests that run the monitor with a fake home directory and verify it does not inspect sibling Skill paths.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (24)

Tainted flow: 'req' from os.environ.get (line 82, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/live_monitor.py (reported line 52)May include surrounding context.

python
f"https://api.search.brave.com/res/v1/web/search?{params}",
                headers={"Accept": "application/json", "X-Subscription-Token": brave_key},
            )
            data = json.loads(urllib.request.urlopen(req, timeout=10).read())
            snippets = []
            for r in data.get("web", {}).get("results", [])[:3]:
                snippet = r.get("description", "")

Tainted flow: 'req' from os.environ.get (line 82, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/live_monitor.py (reported line 87)May include surrounding context.

python
data=payload,
                headers={"X-API-KEY": serper_key, "Content-Type": "application/json"},
            )
            data = _json.loads(urllib.request.urlopen(req, timeout=10).read())
            snippets = []
            for r in data.get("organic", [])[:3]:
                snippet = r.get("snippet", "")

Tainted flow: 'req' from os.environ.get (line 53, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/ticker.py (reported line 57)May include surrounding context.

python
f"https://api.search.brave.com/res/v1/web/search?{params}",
                headers={"Accept": "application/json", "X-Subscription-Token": brave_key},
            )
            data = json.loads(urllib.request.urlopen(req, timeout=10).read())
            snippets = []
            for r in data.get("web", {}).get("results", [])[:3]:
                snippet = r.get("description", "")

Tainted flow: 'req' from os.environ.get (line 53, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/ticker.py (reported line 81)May include surrounding context.

python
f"https://api.search.brave.com/res/v1/web/search?{params}",
                headers={"Accept": "application/json", "X-Subscription-Token": brave_key},
            )
            data = json.loads(urllib.request.urlopen(req, timeout=10).read())
            snippets = []
            for r in data.get("web", {}).get("results", [])[:3]:
                snippet = r.get("description", "")

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The findings show undeclared use of Brave Search and Serper APIs plus reading credentials from external environment and .env files, including another skill's directory. For a skill advertised as using only the free ESPN API, this is a significant trust violation because it introduces secret handling, third-party data sharing, and cross-boundary configuration access that users are not told about.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The findings show undeclared use of Brave Search and Serper APIs plus reading credentials from external environment and .env files, including another skill's directory. For a skill advertised as using only the free ESPN API, this is a significant trust violation because it introduces secret handling, third-party data sharing, and cross-boundary configuration access that users are not told about.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The findings show undeclared use of Brave Search and Serper APIs plus reading credentials from external environment and .env files, including another skill's directory. For a skill advertised as using only the free ESPN API, this is a significant trust violation because it introduces secret handling, third-party data sharing, and cross-boundary configuration access that users are not told about.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The code explicitly attempts to obtain credentials from a .env file belonging to another skill. Accessing secrets outside this skill's own configuration boundary is a real credential-access issue and increases the chance of unauthorized use or later exfiltration.

Content

Scanner excerpt · scripts/live_monitor.py (reported line 64)May include surrounding context.

python
return ""

    def _try_serper(query: str) -> str:
        # Load key from env or web-search-plus .env
        serper_key = os.environ.get("SERPER_API_KEY", "")
        if not serper_key:
            env_paths = [

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

This hardcoded path targets a sibling 'web-search-plus' .env file, indicating intentional cross-component secret access rather than accidental local parsing. In a skill ecosystem, this undermines separation between skills and can expose unrelated API keys to code that was not granted them.

Content

Scanner excerpt · scripts/live_monitor.py (reported line 68)May include surrounding context.

python
serper_key = os.environ.get("SERPER_API_KEY", "")
        if not serper_key:
            env_paths = [
                Path(__file__).parent.parent.parent / "web-search-plus" / ".env",
                Path(os.environ.get("HOME", "/root")) / "clawd/skills/web-search-plus/.env",
            ]
            for ep in env_paths:

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

This alternate path reads a .env file under the user's home directory for another skill, further broadening credential harvesting behavior. The sports skill context makes this especially suspicious because it is unrelated to ESPN score monitoring and shows unnecessary access to unrelated secrets.

Content

Scanner excerpt · scripts/live_monitor.py (reported line 69)May include surrounding context.

python
if not serper_key:
            env_paths = [
                Path(__file__).parent.parent.parent / "web-search-plus" / ".env",
                Path(os.environ.get("HOME", "/root")) / "clawd/skills/web-search-plus/.env",
            ]
            for ep in env_paths:
                if ep.exists():

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code reads API credentials from another skill's .env file, crossing trust boundaries between skills without authorization or user awareness. This is dangerous because it enables secret reuse and lateral access to credentials that were provisioned for a different component, undermining isolation and potentially exposing paid API access or additional account-linked capabilities.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

This function is explicitly designed to obtain credentials, including from files outside the skill's own scope. In this context, credential access is dangerous because the sports ticker has no clear need to inspect another skill's secret storage, and doing so bypasses expected separation between components.

Content

Scanner excerpt · scripts/ticker.py (reported line 22)May include surrounding context.

python
def _load_key(env_var: str, env_file_key: str) -> str:
    """Load API key from env or web-search-plus .env file."""
    key = os.environ.get(env_var, "")
    if not key:
        env_paths = [

Credential Access

High
Category
Privilege Escalation
Confidence
99% confidence
Finding

This path targets a sibling skill's .env file directly, which is a concrete cross-component secret access pattern rather than incidental file handling. If exploited or normalized, it weakens compartmentalization and allows one skill to piggyback on another skill's credentials without authorization.

Content

Scanner excerpt · scripts/ticker.py (reported line 26)May include surrounding context.

python
key = os.environ.get(env_var, "")
    if not key:
        env_paths = [
            Path(__file__).parent.parent.parent / "web-search-plus" / ".env",
            Path(os.environ.get("HOME", "/root")) / "clawd/skills/web-search-plus/.env",
        ]
        for ep in env_paths:

Credential Access

High
Category
Privilege Escalation
Confidence
99% confidence
Finding

This alternate path under the user's home directory continues the same unauthorized secret-discovery behavior, broadening the search for another skill's credentials. That makes the issue more dangerous in this skill context because a simple sports utility should not need to probe user filesystem locations for unrelated secrets.

Content

Scanner excerpt · scripts/ticker.py (reported line 27)May include surrounding context.

python
if not key:
        env_paths = [
            Path(__file__).parent.parent.parent / "web-search-plus" / ".env",
            Path(os.environ.get("HOME", "/root")) / "clawd/skills/web-search-plus/.env",
        ]
        for ep in env_paths:
            if ep.exists():

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares no explicit tool scope even though its documented and inferred behavior requires shell, network, and file access. Missing permission declarations weaken reviewability and allow the skill to request broader capabilities than users may reasonably expect, especially for a seemingly simple sports-alert skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation advertises a force mode that overwrites config.json but does not clearly warn about destructive behavior at the point of use. While not a severe security bug by itself, it can cause accidental data loss and may facilitate unwanted configuration replacement if users or automations invoke it without understanding the consequence.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The implementation expands from ESPN-based sports lookups into general web-search calls to Brave and Serper when no ESPN ID is configured. In context, this is more dangerous because the manifest promises a narrow ESPN-based sports alert feature, while the code silently adds broader network capabilities and third-party data flows that users may not expect.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/live_monitor.py (reported line 49)May include surrounding context.

python
try:
            params = urllib.parse.urlencode({"q": query, "count": 3})
            req = urllib.request.Request(
                f"https://api.search.brave.com/res/v1/web/search?{params}",
                headers={"Accept": "application/json", "X-Subscription-Token": brave_key},
            )
            data = json.loads(urllib.request.urlopen(req, timeout=10).read())

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/ticker.py (reported line 54)May include surrounding context.

python
try:
            params = urllib.parse.urlencode({"q": query, "count": 3})
            req = urllib.request.Request(
                f"https://api.search.brave.com/res/v1/web/search?{params}",
                headers={"Accept": "application/json", "X-Subscription-Token": brave_key},
            )
            data = json.loads(urllib.request.urlopen(req, timeout=10).read())

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill reads a SERPER_API_KEY from another skill's .env file, crossing intended isolation boundaries and accessing credentials unrelated to this skill's declared purpose. This is dangerous because it enables credential harvesting and reuse without the user's explicit consent, and could leak or misuse secrets from adjacent components on the same host.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises ESPN-based sports alerts, but it also performs general web searches through Brave and Serper when ESPN data is unavailable. This creates undisclosed outbound data flow and behavior that exceeds user expectations, which is dangerous because users may not realize their team queries are being sent to third-party search providers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill silently accesses a sensitive credential from another skill's .env file with no disclosure, consent, or user-facing warning. Even if the intent is convenience, this is dangerous because it hides secret usage, frustrates auditing, and can cause users to unknowingly fund or authorize third-party API calls through unrelated credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The README explicitly states that generated JSON configs are processed by the agent to create or update scheduled automations, but it does not clearly warn users that this can modify persistent platform scheduling state. In an agent ecosystem, instructions that lead an agent to create, enable, disable, or retime automations can have security and safety implications because users may not realize they are authorizing ongoing background actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The module docstring says the script 'Outputs JSON configurations that the agent can use' and 'Does NOT create crons directly,' which presents it as a generator/formatter for cron configs. In addition to printing JSON, the code also persists those configs to cron_configs.json on disk, which is extra behavior not reflected in the manifest-level purpose of a live sports alert skill or in the script's own top-level description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.