ClawHub
Back to skill

Security audit

Sharp Line Detector

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent sports-odds monitoring helper, with disclosed external API use and local snapshot files, but users should protect their Odds API key and snapshot directory.

Install only if you are comfortable giving the skill an Odds API key and allowing it to create local odds snapshot files. Keep shell tracing and verbose logging off around the command, restrict or rotate the API key if needed, and use trusted SPORT_KEY and SHARP_SNAPSHOT_DIR values.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:57
Finding

API Credential Exposed Through a URL Query Parameter

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 57
Vulnerability Type: API credential exposure through command-line URL
Risk Level: Medium

bash
curl -s "https://api.the-odds-api.com/v4/sports/$SPORT_KEY/odds?apiKey=$ODDS_API_KEY&regions=us,eu&markets=h2h,spreads&oddsFormat=american&bookmakers=pinnacle,circasports,bookmaker,betonlineag,draftkings,fanduel" \

Technical Analysis

The documented command expands ODDS_API_KEY directly inside a URL passed as a command-line argument to curl. Although HTTPS protects the URL while it is in transit, it does not prevent exposure at the originating host or terminating infrastructure.

The expanded URL can be observable through process inspection while curl is running. It may also be captured by diagnostic tooling, verbose execution wrappers, HTTP proxies, monitoring systems, crash reports, or server-side request logs. Any component that records the complete request URL would consequently record the credential.

Attack Path

  1. A user configures ODDS_API_KEY and runs the documented snapshot command.
  2. The shell expands the environment variable into the URL supplied to curl.
  3. A local process with sufficient process-inspection access, or an authorized intermediary that records request URLs, captures the expanded URL.
  4. The observer extracts the apiKey query parameter.
  5. The exposed key is reused to make requests against the Odds API until it is revoked or otherwise restricted.

Impact Assessment

Successful exploitation exposes the Odds API credential available to the skill. An attacker could consume the associated API quota, create unexpected service charges where applicable, disrupt legitimate requests through quota exhaustion, and access any API functionality authorized to that key.

This issue does not itself grant operating-system privileges or access beyond the permissions assigned to the exposed API credential. T ...[truncated 146 chars]

Remediation
View remediation

Remediation Suggestions

  • Use a provider-supported authorization header instead of placing the credential in the URL, if the API supports header-based authentication.
  • If query-string authentication is mandatory, avoid exposing the expanded URL in process arguments by supplying sensitive curl configuration through a protected file descriptor or a temporary configuration file with mode 0600.
  • Ensure proxy, application, and API gateway logs redact authentication query parameters.
  • Disable shell tracing around credential-bearing commands and avoid verbose curl output in production.
  • Restrict the API key by permitted API operations, source IP addresses, quotas, and spending limits where supported.
  • Rotate the key if it may previously have been captured in logs or monitoring systems.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:52
Finding

Unvalidated Sport Key Allows Snapshot Path Traversal

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52–78
Vulnerability Type: Path traversal through an unvalidated environment variable
Risk Level: Low

bash
SPORT_KEY="${SPORT_KEY:-basketball_nba}"
SNAP_DIR="${SHARP_SNAPSHOT_DIR:-/tmp/openclaw-sharp-snapshots}"
mkdir -p "$SNAP_DIR"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)

curl -s "https://api.the-odds-api.com/v4/sports/$SPORT_KEY/odds?apiKey=$ODDS_API_KEY&regions=us,eu&markets=h2h,spreads&oddsFormat=american&bookmakers=pinnacle,circasports,bookmaker,betonlineag,draftkings,fanduel" \
  | jq --arg ts "$TIMESTAMP" '{
    timestamp: $ts,
    sport: "'$SPORT_KEY'",
    games: [.[] | {
      id: .id,
      game: "\(.away_team) @ \(.home_team)",
      away: .away_team,
      home: .home_team,
      start: .commence_time,
      books: [.bookmakers[] | {
        key: .key,
        name: .title,
        h2h: [(.markets[] | select(.key=="h2h")).outcomes[] | {team: .name, odds: .price}],
        spread: [(.markets[] | select(.key=="spreads")).outcomes[] | {team: .name, point: .point, odds: .price}]
      }]
    }]
  }' > "$SNAP_DIR/${SPORT_KEY}_${TIMESTAMP}.json"

Technical Analysis

SPORT_KEY is accepted from the environment without validation and is then incorporated into the output filename. Shell quoting prevents command substitution and ordinary shell argument injection, but it does not neutralize filesystem path separators or .. traversal components.

A value containing traversal sequences can cause the redirection target to resolve outside SNAP_DIR. Shell redirection creates or truncates the destination before the pipeline executes, so the file operation can occur even if the manipulated API request fails or jq cannot parse its response.

The automatically appended timestamp and .json suffix constrain the filenames that can be targeted. Exploitation also requires the destination's parent directories to e ...[truncated 1409 chars]

Remediation
View remediation

Remediation Suggestions

  • Validate SPORT_KEY against an explicit allowlist of sport identifiers accepted by the API.
  • At minimum, enforce a restrictive pattern such as ^[A-Za-z0-9_]+$ and reject empty values, path separators, . components, and .. components.
  • Construct the output filename from a validated or normalized identifier rather than directly from environment input.
  • Resolve the canonical destination path and verify that it remains beneath the canonical SNAP_DIR path before writing.
  • Create files with restrictive permissions, for example by setting umask 077.
  • Consider using a securely created temporary file inside SNAP_DIR, followed by an atomic rename after successful download and JSON validation.
  • Fail closed when the API request or jq transformation fails so invalid or empty snapshots are not installed as completed output.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
mkdir -p "$SNAP_DIR"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)

curl -s "https://api.the-odds-api.com/v4/sports/$SPORT_KEY/odds?apiKey=$ODDS_API_KEY&regions=us,eu&markets=h2h,spreads&oddsFormat=american&bookmakers=pinnacle,circasports,bookmaker,betonlineag,draftkings,fanduel" \
  | jq --arg ts "$TIMESTAMP" '{
    timestamp: $ts,
    sport: "'$SPORT_KEY'",

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The skill requires ODDS_API_KEY and later uses it in a curl request to api.the-odds-api.com. Although this is consistent with the skill's purpose, the markdown does not explicitly disclose that the skill will contact an external service using the user's API credential.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill documentation instructs the agent to capture and store odds snapshots as JSON files, which affects the local filesystem. While the operation is described functionally, it does not explicitly warn the user that running the skill will create persistent files under a directory such as /tmp/openclaw-sharp-snapshots.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.