Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Betting Research

v1.0.0

Multi-source sports betting research tool. Aggregates odds, team form, head-to-head history, weather conditions, and injury data to identify value betting op...

0· 100·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for stigg86/betting-research.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Betting Research" (stigg86/betting-research) from ClawHub.
Skill page: https://clawhub.ai/stigg86/betting-research
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install betting-research

ClawHub CLI

Package manager switcher

npx clawhub@latest install betting-research
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's stated purpose (betting research) aligns with the included Python script and referenced APIs. However metadata claims no required binaries or env vars while the script reads APIFOOTBALL_KEY / ODDS_API_KEY environment variables (as fallbacks) and expects config files under ~/.config. More importantly, the script attempts to run a Node-based helper at ~/.openclaw/workspace/skills/search-x/scripts/search.js, but the skill does not declare a dependency on that other skill or on the 'node' binary. Requiring execution of another skill's script without declaring it is an incoherence.
!
Instruction Scope
SKILL.md instructions are generally limited to running the included Python script and storing API keys in ~/.config paths — those are appropriate. The runtime code however will attempt to execute a local Node script from a different skill path (~/.openclaw/.../search-x/scripts/search.js) via subprocess.run to fetch X/Twitter results; this expands the execution scope to run potentially arbitrary code from the workspace and is not documented as a dependency in SKILL.md. The script also reads files in ~/.config and the workspace, which SKILL.md partially documents for API keys but not for cross-skill execution.
Install Mechanism
No install spec is provided (instruction-only with an included script). Nothing is downloaded or extracted by the skill itself, which lowers installation risk.
Credentials
The skill asks for API keys for API-Football and The Odds API — these are proportional to its functionality. It suggests storing them in ~/.config/api-football/config.json and ~/.config/the-odds-api/key, and the script will also accept APIFOOTBALL_KEY and ODDS_API_KEY environment variables. The metadata declared no required env vars which is arguably misleading but not dangerous. No unrelated credentials are requested.
Persistence & Privilege
The skill is not always-enabled and does not request elevated or persistent privileges. It does not modify other skills' configs; it only reads files from the user's home directory and workspace when run.
What to consider before installing
This skill appears to implement what it claims (aggregating sports APIs), but take these precautions before running or installing: 1) Review the included scripts yourself — the Python code will try to execute a Node script at ~/.openclaw/workspace/skills/search-x/scripts/search.js if present. That means it can run code from other skills/workspace entries; verify that search-x (and any Node code) is trustworthy or remove/disable those calls. 2) The skill expects API keys in ~/.config or as env vars (APIFOOTBALL_KEY, ODDS_API_KEY); keep secrets in a safe place and avoid world-readable files. 3) If you don't want cross-skill execution, either ensure 'search-x' isn't installed or edit the Python script to remove the subprocess/node calls. 4) Ensure you have (or intentionally install) node if you want the X/Twitter lookups to work; the skill doesn't declare node as a required binary. If you want me to, I can summarize exactly where the script executes external binaries and produce a patch to disable those calls.

Like a lobster shell, security has layers — review code before you run it.

latestvk97407kh3fwxv1wxftqqn0v9r183sasb
100downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

Betting Research

Multi-source data aggregator for sports betting analysis. Pulls from free and paid APIs to give you an edge.

Data Sources

SourceDataCostRate Limit
TheSportsDBFixtures, results, H2H, team infoFreeNo limit
API-FootballLineups, injuries, player stats, xG100 calls/day free100/day
Open-MeteoWeather (precipitation, wind)FreeNo limit
The Odds APICurrent odds, bookmaker prices500 calls/month free500/mo

Quick Start

# Research a specific match
python3 ~/.openclaw/workspace/skills/betting-research/scripts/betting_research.py "Liverpool vs Everton"

# Research a team
python3 ~/.openclaw/workspace/skills/betting-research/scripts/betting_research.py --team "Bolton Wanderers"

What You Get

Basic Analysis (Free APIs)

  • ✅ Team form (last 5 matches)
  • ✅ Win/draw/loss record
  • ✅ Goals scored/conceded
  • ✅ Upcoming fixtures
  • ✅ Head-to-head history
  • ✅ Weather conditions

Pro Analysis (with API-Football key)

  • ⭐ Confirmed lineups (1 hour before kickoff)
  • ⭐ Injury/suspension reports
  • ⭐ Expected goals (xG) data
  • ⭐ Player form and ratings
  • ⭐ Manager tactics info

Setup

The Odds API (already have)

Key stored at: ~/.config/the-odds-api/key

API-Football (optional, for pro features)

  1. Sign up: https://www.api-football.com/pricing
  2. Get free tier: 100 calls/day
  3. Save key:
mkdir -p ~/.config/api-football
echo '{"api_key": "YOUR_KEY"}' > ~/.config/api-football/config.json

Usage Examples

Pre-match research:

python3 ~/.openclaw/workspace/skills/betting-research/scripts/betting_research.py "Bolton vs Plymouth"

Full analysis (uses more API calls):

python3 ~/.openclaw/workspace/skills/betting-research/scripts/betting_research.py "Liverpool vs Man City" --full

Check multiple games efficiently:

# Uses only 3-4 API calls per match
# 100 calls = ~25 matches per day

Interpreting Results

Value Indicators

  • Form streaks — teams on hot/cold runs
  • H2H dominance — historical advantage
  • Weather impact — rain = lower scoring
  • Odds mispricing — bookie odds vs. true probability

What NOT to Expect

  • ❌ Guaranteed winners
  • ❌ "Bet on this" tips
  • ❌ Inside information

What TO Expect

  • ✅ Data patterns
  • ✅ Value opportunities
  • ✅ Informed decisions

Pro Tips

  1. Check lineups 1 hour before kickoff — key players resting = different bet
  2. Weather matters — rain, wind affect totals (under value)
  3. H2H at this venue — home advantage varies by team
  4. Motivation check — cup games, relegation battles

API Call Budgeting

TaskCalls
Basic match research3-4
Full analysis + lineups8-10
Team form check2-3
Odds comparison1

100 calls/day = 10-15 full match analyses

See references/data-sources.md for API details.

Comments

Loading comments...