ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Sharp Line Detector

v1.1.0

Monitor line movements at sharp sportsbooks (Pinnacle, Circa, Bookmaker). Detect steam moves, reverse line movement, and significant implied probability shif...

⭐ 0· 49·0 current·0 all-time
by@rsquaredsolutions2026
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
ℹ
Purpose & Capability
The skill claims to monitor sharp sportsbook lines and its instructions call The Odds API and parse/save odds — this is coherent. However, the registry metadata lists no required environment variables while SKILL.md documents a credential (ODDS_API_KEY) and a credentials block, which is inconsistent. Also python3 is listed as a required binary but the provided snippet only uses curl and jq.
✓
Instruction Scope
SKILL.md is instruction-only and the runtime steps are limited: perform a curl to api.the-odds-api.com with an API key, jq-process the JSON, and write timestamped snapshots to a configurable local directory (default /tmp/openclaw-sharp-snapshots). The instructions do not request unrelated files, system credentials, or network endpoints beyond The Odds API and linked documentation.
✓
Install Mechanism
There is no install spec (instruction-only), so nothing is downloaded or written by an installer. This minimizes supply-chain risk.
ℹ
Credentials
The skill reasonably needs an Odds API key (ODDS_API_KEY) to function; that credential is declared inside SKILL.md. But the registry metadata omitted required env vars, creating a mismatch the publisher should resolve. No other credentials or broad secrets are requested.
✓
Persistence & Privilege
The skill does not request elevated presence (always: false) and only writes snapshot JSON files to a configurable directory. Autonomous model invocation is allowed (platform default) but not by itself a red flag here.
Assessment
This skill appears to do what it claims: call The Odds API, parse odds, and save snapshots. Before installing: 1) Confirm you will provide an ODDS_API_KEY (the SKILL.md expects this) and that the registry metadata is updated to reflect that requirement. 2) Consider setting SHARP_SNAPSHOT_DIR to a location you control (not world-writable) if you care about where files land. 3) The SKILL.md lists python3 as required but the sample uses only curl and jq—ask the publisher why python3 is required. 4) Verify you trust the skill owner (no homepage/source is included in the registry metadata). 5) Limit the API key scope/permissions where possible and rotate the key if you later remove the skill.

Like a lobster shell, security has layers — review code before you run it.

agentbetsvk979rpv981vrkn3mfys21ywd0983jd3rbettingvk979rpv981vrkn3mfys21ywd0983jd3rlatestvk979rpv981vrkn3mfys21ywd0983jd3ropenclawvk979rpv981vrkn3mfys21ywd0983jd3rprediction-marketsvk979rpv981vrkn3mfys21ywd0983jd3rsports-bettingvk979rpv981vrkn3mfys21ywd0983jd3r

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🔍 Clawdis
Binscurl, jq, python3

Comments