Sports Ticker
WarnAudited by ClawScan on May 10, 2026.
Overview
The sports alert function is mostly coherent, but the skill can read a search API key from another skill’s local .env file despite saying no API keys are needed.
Review the code before installing. The ESPN sports-alert behavior appears aligned with the description, but the web-search fallback should not borrow API keys from another skill. If you install it, avoid sharing unrelated .env files, require explicit approval before cron creation, and check any generated cron jobs so they only run when you want them to.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill may use a search API credential that the user configured for a different skill, potentially consuming quota or exposing that credential boundary without clear consent.
The skill looks for SERPER_API_KEY in another skill's .env file and a user home skill path, even though the metadata/SKILL.md say no API keys are required.
env_paths = [
Path(__file__).parent.parent.parent / "web-search-plus" / ".env",
Path(os.environ.get("HOME", "/root")) / "clawd/skills/web-search-plus/.env",
]Do not read credentials from another skill’s .env file. Require the user to explicitly provide an optional SERPER_API_KEY or BRAVE_SEARCH_API_KEY for this skill and disclose the fallback clearly in metadata and docs.
If approved, the skill can set up ongoing background sports-alert checks that continue after the initial request.
The script outputs instructions for the agent to create OpenClaw cron jobs, including recurring match-monitoring jobs.
"instructions": "Use the cron tool (action=add) to create these jobs. Do NOT use subprocess or CLI."
Only create cron jobs after explicit user confirmation, and show the schedule, purpose, and how to disable or delete each job.