Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Cross-Market Pricer
v1.1.0Normalize odds across Polymarket, Kalshi, and sportsbooks into a unified implied-probability format. Enables apples-to-apples comparison for the same event a...
⭐ 0· 78·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description match the actions in SKILL.md: fetching odds from sportsbooks (The Odds API), Polymarket, and Kalshi and normalizing them. Required binaries (curl, jq, python3) are appropriate. However, SKILL.md declares a required credential (ODDS_API_KEY) that the registry metadata did not list — a metadata mismatch.
Instruction Scope
Instructions are scoped to calling public APIs and converting odds formats. They do not instruct reading system files or unrelated credentials. Concerns: SKILL.md is partially truncated at the end and repeatedly relies on the agent to 'fill in' placeholders from context — this ambiguity could cause the agent to gather broader context than necessary if not constrained.
Install Mechanism
No install spec or code is present (instruction-only), so nothing is written to disk or downloaded by the skill itself — lowest install risk.
Credentials
SKILL.md requests a single external API key (ODDS_API_KEY for The Odds API), which is proportional to fetching sportsbook odds. But the registry metadata omitted declaring this required env var / primary credential; that inconsistency could lead to missing user warnings or accidental disclosure. No other credentials or config paths are requested.
Persistence & Privilege
always is false, autonomous invocation is allowed (platform default) and acceptable here. The skill does not request persistent or system-wide changes.
What to consider before installing
This skill appears to do what it says (normalizing market odds) but has two issues you should address before installing: (1) Metadata mismatch — SKILL.md requires ODDS_API_KEY but the registry metadata doesn't declare it. Ask the publisher to update the registry to list ODDS_API_KEY (and explain where it will be used). (2) SKILL.md is partially truncated and uses many placeholders that the agent is asked to 'fill from context' — request the complete instructions and confirm exactly what context the agent should use so it won't indiscriminately read or include unrelated user data. Only provide a minimal-scope API key (or a test/unprivileged key) for The Odds API, and do not supply other credentials. If you rely on this skill in production, verify endpoints and test with dummy data first.Like a lobster shell, security has layers — review code before you run it.
agentbetsvk97ca6nb84fmvwm388my5fh64h83jwjzbettingvk97ca6nb84fmvwm388my5fh64h83jwjzlatestvk97ca6nb84fmvwm388my5fh64h83jwjzopenclawvk97ca6nb84fmvwm388my5fh64h83jwjzprediction-marketsvk97ca6nb84fmvwm388my5fh64h83jwjzsports-bettingvk97ca6nb84fmvwm388my5fh64h83jwjz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
⚖️ Clawdis
Binscurl, jq, python3