Odds Movement Monitor 盘口监控

• Outcome: Review
• Latest audit: May 28, 2026 · 7:28 AM UTC
• Version: 1.0.0

Overview

This odds-monitoring skill is mostly coherent, but it includes payment code that can charge a SkillPay/USDT balance without clear per-use confirmation.

Install only if you trust the publisher and are comfortable with SkillPay billing for each use. Avoid autonomous repeated invocations unless billing limits and confirmations are enforced, treat ODDS_API_KEY and SKILLPAY_USER_ID as sensitive, and prefer a version that removes the hard-coded billing key, uses platform-scoped identity, asks before charging, and pins dependencies.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (15)

Tainted flow: 'user_id' from os.environ.get (line 96, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

返回: {"ok": bool, "balance": float, "payment_url": str|None}
    """
    try:
        resp = requests.post(
            f"{BILLING_API_URL}/api/v1/billing/charge",
            headers=HEADERS,
            json={

• Confidence: 99% confidence
• Finding: The function named as payment verification performs an actual charge against a remote billing API using an environment-derived user identity. This creates a hidden side effect where simply starting the skill can debit an account without clear prior user consent, and anyone controlling or misconfiguring SKILLPAY_USER_ID could cause charges against the wrong account.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence
• Finding: The skill advertises networked monitoring, data collection, and possible environment access, but does not declare permissions. That creates a transparency and consent problem: a host or user may invoke it without understanding that it can reach external services or access environment-backed secrets, which increases the chance of data exposure or unintended outbound requests. In this context, the risk is real because the skill explicitly references external odds providers and a payment system, making undeclared network use more operationally significant.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill description presents itself as an odds-monitoring assistant, but the content indicates third-party billing and per-call charging behavior not reflected in the stated purpose. Hidden monetization and external payment-service interaction are dangerous because they can cause unauthorized charges, unexpected data sharing with a payment provider, and trust-boundary violations; the finding is especially concerning because it mentions hardcoded billing credentials and automatic charging behavior.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script prepends a path under the user's home workspace to sys.path before importing code, which allows Python to resolve imports from an uncontrolled local directory. In an agent/skill environment, that makes execution dependent on whatever files exist at that path and can lead to unintended or malicious code execution if the workspace contents are modified or spoofed.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file implements billing enforcement for a skill whose declared purpose is odds and line movement monitoring, with no monitoring logic present here. Mismatch between stated capability and actual behavior is a strong trust and supply-chain concern because users or reviewers may invoke the skill expecting analytics while the code instead performs account-linked billing operations.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill reads runtime identity from SKILLPAY_USER_ID even though the stated skill purpose does not justify collecting identity data. In context, this is more dangerous because the identity is immediately used for billing actions, increasing the chance of privacy leakage, cross-user charging, or unauthorized billing if the environment is manipulated.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The docstring says the function verifies whether the user has paid, but the implementation immediately calls charge_user, which attempts to debit the account. This deceptive naming materially increases risk because callers may invoke it assuming it is a harmless check, causing unintended charges and bypassing informed consent.

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: A broad invocation description can cause the skill to trigger on generic betting-analysis requests beyond the user's intended scope. That matters here because the skill claims live monitoring, alerts, external data access, and paid usage, so overbroad routing could lead to unnecessary third-party calls, unintended monitoring actions, or accidental billing.

Vague Triggers

Medium

• Confidence: 74% confidence
• Finding: The example triggers are generic and action-oriented, which increases the likelihood that the orchestrator invokes this skill for loosely related requests without confirming user intent. In this skill's context, that is more dangerous than usual because the skill may contact external providers, initiate ongoing monitoring, and potentially engage a billing workflow.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The charge request transmits user_id to a third-party billing API on the successful path without any user-facing disclosure or consent prompt. In a skill unrelated to payments, silent identity transmission tied to account debiting is a meaningful privacy and trust issue and can obscure who is being billed and why.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The code accesses an environment-derived user identity and uses it for billing without any explicit notice before use. This is risky because ambient identity sources are easy to misuse, and in this skill context there is no obvious user expectation that launching odds monitoring will read identity for payment processing.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

aiohttp>=3.8.0
requests>=2.28.0

• Confidence: 96% confidence
• Finding: The dependency is specified with only a lower bound, which allows future installs to resolve to different versions over time and can unintentionally pull in vulnerable or breaking releases. In a monitoring skill that likely performs network I/O, supply-chain instability increases the chance of introducing exploitable dependency behavior without code changes.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

aiohttp>=3.8.0
requests>=2.28.0

• Confidence: 96% confidence
• Finding: The requests package is also unpinned, so deployments are not reproducible and may consume newly published versions or dependency trees with security regressions. Because this skill likely connects to external platforms for odds data, network-facing libraries should be tightly controlled to reduce supply-chain and patch-management risk.

Known Vulnerable Dependency: aiohttp — 10 advisory(ies): CVE-2024-52303 (aiohttp has a memory leak when middleware is enabled when requesting a resource ); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi); CVE-2026-34517 (AIOHTTP has late size enforcement for non-file multipart fields causes memory Do) +7 more

High

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: The file permits installation of aiohttp versions with multiple known advisories, and the open-ended specifier does not demonstrate that a patched release is required. Since aiohttp is commonly used for handling HTTP client/server interactions and multipart processing, known flaws such as header injection or resource exhaustion can become remotely triggerable depending on usage.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: The requirements allow requests versions affected by published security issues, including credential leakage and TLS/session verification concerns noted by the scanner. For a skill that likely fetches data from multiple third-party endpoints, vulnerable HTTP client behavior can expose secrets, weaken transport assurances, or enable attacker-controlled URLs to exfiltrate sensitive information.

Static analysis

No suspicious patterns detected.