World Cup 2026 Odds Tracker
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This instruction-only skill is coherent for fetching World Cup odds, but users should notice it relies on an external Odds API key.
Before installing, confirm you are comfortable providing an ODDS_API_KEY for The Odds API. The provided artifacts do not show code, persistence, file writes, or account-changing actions.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may use your Odds API key to retrieve odds data, which could consume API quota or expose the key to that provider as intended by the request.
The skill expects an API key and sends it to The Odds API as part of the documented odds-fetching request. This is consistent with the skill's purpose, but it is still credential use.
credentials:\n - id: "odds-api-key"\n name: "The Odds API Key"\n env: "ODDS_API_KEY" ... curl -s "https://api.the-odds-api.com/.../odds?apiKey=$ODDS_API_KEY...
Use a limited-purpose Odds API key, monitor quota usage, and avoid sharing broader or unrelated credentials with this skill.