ClawHub
Back to skill

Security audit

Odds Movement Monitor 盘口监控

Security checks for vulnerabilities and agentic risk

Overview

The odds-monitoring skill is mostly coherent, but it contains direct billing code that can charge a user identifier through an external payment service without a clear per-run approval flow.

Review before installing. The sports-odds monitoring functions match the advertised purpose, but the skill includes direct SkillPay billing code, a hardcoded billing API key, and external transmission of SKILLPAY_USER_ID. Install only if you trust the publisher and billing provider, understand that usage may incur USDT charges, and can control or sandbox the billing-related environment variables and network access.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Tainted flow: 'user_id' from os.environ.get (line 96, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
返回: {"ok": bool, "balance": float, "payment_url": str|None}
    """
    try:
        resp = requests.post(
            f"{BILLING_API_URL}/api/v1/billing/charge",
            headers=HEADERS,
            json={
Confidence
98% confidence
Finding
The code automatically sends an environment-derived user identifier to an external billing service and attempts to charge the user on skill start, without prior consent or clear disclosure. In this skill context, that behavior is unrelated to odds monitoring and can lead to unauthorized charges and covert exfiltration of user-linked data to a third party.

Tainted flow: 'user_id' from os.environ.get (line 96, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
def get_payment_link(user_id: str, amount: float = 5.0) -> str:
    """生成充值链接"""
    try:
        resp = requests.post(
            f"{BILLING_API_URL}/api/v1/billing/payment-link",
            headers=HEADERS,
            json={"user_id": user_id, "amount": amount},
Confidence
93% confidence
Finding
This sends the user identifier to an external payment-link endpoint to generate a recharge URL, again without user-facing consent or necessity for the advertised skill function. While less severe than direct charging, it still exposes user-linked data to a third party and facilitates unsolicited monetization behavior.

Lp3

Medium
Category
MCP Least Privilege
Confidence
80% confidence
Finding
The skill advertises operational capabilities that imply network and environment access, but no explicit permissions are declared. This creates a transparency and governance gap: users and the platform cannot accurately assess what the skill may access at runtime, which is especially relevant for a tool that polls external services and may use API keys or tokens from the environment.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The skill’s stated purpose is odds monitoring, but the content introduces an external paid-calling system and the static analysis indicates billing, payment verification, recharge-link generation, and a hardcoded billing API key unrelated to the declared monitoring function. Hidden or under-declared monetization and payment workflows are dangerous because they can trigger unauthorized charges, route users to third-party payment infrastructure, and expand data/secrets exposure beyond what users reasonably expect from a sports-analysis skill.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The file implements payment enforcement and billing integration instead of the advertised odds-movement monitoring functionality. That mismatch is a strong indicator of deceptive or unauthorized behavior because users and reviewers would expect sports analytics, not monetization logic that can terminate execution unless payment succeeds.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The skill reads an environment-based user identifier and performs external billing actions that are not justified by the stated purpose of monitoring sports odds. In context, this increases risk because the hidden billing flow is unexpected, privacy-invasive, and difficult for end users to audit or meaningfully consent to.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The docstring says the function merely verifies payment status, but the implementation immediately calls charge_user and attempts to bill the user. This deceptive naming and documentation can hide monetization side effects from maintainers, reviewers, and users, increasing the likelihood of unauthorized charges and making the behavior especially dangerous in a non-billing skill.

Missing User Warnings

Medium
Confidence
99% confidence
Finding
A live-looking billing API key is hardcoded directly in the source file and used for outbound payment requests. Hardcoded secrets are easily leaked through source distribution, logs, or repository exposure, enabling unauthorized use of the billing account and abuse of the associated payment infrastructure.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The code automatically initiates a billing charge and transmits the user identifier to an external service without prior warning or confirmation. In this skill context, that is especially dangerous because payment collection is unrelated to the advertised function and can result in unauthorized charges and undisclosed third-party data sharing.

Static analysis

No suspicious patterns detected.