Hong Kong Horse Racing
v1.2.0Fetches Hong Kong Jockey Club race cards with horse details, odds, and up to 4 recommended picks per race including reasoning and win probability; supports E...
⭐ 0· 156·0 current·0 all-time
bySteven Ho@stevenho1394
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the implementation: skill loads hkjc-api, fetches race data, filters SB horses, computes recommendations with optional advanced scoring. No unrelated credentials, binaries, or config paths are requested.
Instruction Scope
SKILL.md and skill.js confine runtime behavior to fetching HKJC race data, caching, rate-limiting, and computing picks. The only minor mismatch: plugin metadata mentions fetching news sentiment via Brave search, while the code's newsBoost is a stub that currently returns 0 (no external web-search performed). Otherwise instructions do not ask to read system files or environment secrets.
Install Mechanism
No special install script besides 'npm install' for declared dependency hkjc-api. package-lock.json shows packages pulled from the public npm registry (no direct downloads from arbitrary URLs or IPs).
Credentials
The skill declares no required environment variables or credentials and the code does not access env vars or config paths. Network access to fetch HKJC data is required and documented.
Persistence & Privilege
Skill does not request 'always: true' or other elevated persistent privileges. It uses an in-memory cache and a local rate-limit timestamp; it does not modify other skills or global agent settings.
Assessment
This skill appears to do what it says: fetch HKJC race data and compute recommendations. Before installing: (1) Confirm you are comfortable granting the skill outbound network access to fetch HKJC data; (2) Review the hkjc-api npm package (and its recent versions) for reputation and any recent advisories (run 'npm audit'); (3) Note the plugin metadata mentions a Brave-search newsBoost but the code's newsBoost is currently a no-op — be cautious if that feature is later implemented since it could introduce additional network destinations; (4) If you need stricter control, run the skill in a restricted environment (eg. network egress rules) and inspect the installed node_modules after npm install.Like a lobster shell, security has layers — review code before you run it.
latestvk974rf43kcmq2021tqywh4h6q5837xrj
License
MIT-0
Free to use, modify, and redistribute. No attribution required.