Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Arbitrage Finder
v1.1.0Detect guaranteed-profit arbitrage opportunities across sportsbooks and prediction markets. Compares odds from 20+ bookmakers, Polymarket, and Kalshi. Calcul...
⭐ 0· 78·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (finding arbs across sportsbooks, Polymarket, Kalshi) aligns with the runtime instructions: curl + jq calls to The Odds API, Polymarket, and Kalshi and Python for calculations. Required binaries (curl, jq, python3) are appropriate for the shown commands. However, the SKILL.md declares a credential (ODDS_API_KEY) that the registry metadata ( Requirements: 'Required env vars: none') does not list — that's an internal mismatch.
Instruction Scope
Instructions are narrowly scoped to fetching odds/prices from external APIs and performing arithmetic to detect arbs and compute stakes. They do not instruct reading local files or other system state. They will perform outbound network requests to third-party endpoints (the-odds-api.com, gamma-api.polymarket.com, api.elections.kalshi.com), which is expected for this purpose but worth noting because data (queries/results) are transmitted externally.
Install Mechanism
Instruction-only skill with no install spec or code files — nothing is written to disk by an installer. This is the lowest install risk.
Credentials
SKILL.md declares a required credential (The Odds API key → ODDS_API_KEY) as metadata, which is appropriate for calling The Odds API. However, the registry metadata for the skill reported 'Required env vars: none' — a clear inconsistency. The skill otherwise does not request unrelated secrets or multiple credentials, so the single API key is proportionate if the registry correctly lists it.
Persistence & Privilege
The skill does not request always:true and is user-invocable with normal autonomous invocation; it does not attempt to modify other skills or system settings in the instructions. No persistence or elevated privileges are requested.
What to consider before installing
This skill appears to do what it says (query odds and detect arbitrage), but take these precautions before installing:
- Confirm the ODDS_API_KEY requirement: SKILL.md expects an API key for The Odds API (ODDS_API_KEY). The registry listing omitted that — verify the installer will request this environment variable and you are comfortable providing it.
- Consider provenance risk: there is no source repository or homepage and the owner is unknown. If you don't trust the publisher, avoid providing credentials or run the skill in an isolated environment.
- Minimize risk of credential exposure: create and use a limited-scope API key you can revoke, not any broader account credential.
- Expect network traffic: the skill will make outbound requests to the-odds-api.com, polymarket (gamma-api.polymarket.com), and Kalshi endpoints — only supply data you are comfortable sending to those services.
- If possible, view the full SKILL.md (and any truncated code) before installing to confirm there are no hidden commands that access local files or other env vars. If the registry metadata remains inconsistent (omits the declared credential), treat that as a red flag and ask the publisher for clarification.
If you want, I can extract the remainder of the truncated Python stake-calculation portion and scan it for questionable operations before you proceed.Like a lobster shell, security has layers — review code before you run it.
agentbetsvk978f1ae6gwsxjb85bzv1m1ch583gs5sbettingvk978f1ae6gwsxjb85bzv1m1ch583gs5slatestvk978f1ae6gwsxjb85bzv1m1ch583gs5sopenclawvk978f1ae6gwsxjb85bzv1m1ch583gs5sprediction-marketsvk978f1ae6gwsxjb85bzv1m1ch583gs5ssports-bettingvk978f1ae6gwsxjb85bzv1m1ch583gs5s
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🔀 Clawdis
Binscurl, jq, python3
