Betting Research

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:42 AM UTC
• Version: 1.0.0

Overview

This betting research skill is mostly purpose-aligned, but it under-discloses that it can automatically run another local X/Twitter search script and it stores/reads API keys from local plaintext config files.

Review before installing. Use separate low-privilege API keys, prefer environment or platform secret storage over plaintext files, and verify or disable the search-x dependency because this skill may run that separate local Node.js script automatically for lineup and injury searches.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This is a true security-relevant mismatch because the documented behavior understates sensitive actions: reading API keys from local config paths and invoking an external local Node-based skill/script via subprocess are materially different from simple betting research. Hidden credential access and undeclared subprocess/tool invocation expand the trust boundary and could expose secrets or allow unintended command execution pathways.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises executable usage and, per the accompanying analysis, has shell, network, and environment access but does not declare any permissions or allowed tools. This weakens reviewability and containment because consumers cannot tell that the skill can read local state and make external requests, increasing the chance of unintended data access or tool abuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest says to use the skill when a user 'asks about specific matches, wants betting analysis, or needs data-driven predictions for sports betting,' which is a broad natural-language trigger description rather than a narrow invocation scope. It does not provide exclusion conditions or negative examples, so the skill could be invoked for general sports discussion or prediction requests more broadly than intended.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill instructs users to persist an API key in a long-lived plaintext config file under the home directory. While common, this creates residual secret exposure risk if local permissions are weak, backups are shared, or other tools/skills on the host can read the file.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

2. Get free tier: 100 calls/day
3. Save key:

bash

mkdir -p ~/.config/api-football
echo '{"api_key": "YOUR_KEY"}' > ~/.config/api-football/config.json

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill silently reads sensitive credential files from the user's home directory without any user-facing disclosure or permission check. In an agent/skill environment, undisclosed secret access violates least surprise and can become dangerous if combined with logging, subprocesses, or future code changes that expose or misuse those credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

User-supplied team names are sent to third-party services without explicit disclosure or consent. While the data is not highly sensitive in most cases, silent external transmission is a privacy and policy concern in agent contexts, especially when the host or user may assume analysis is local.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/betting_research.py (reported line 106)May include surrounding context.

python

# Map to odds-api format
    sport_key = sport.lower().replace(' ', '_')
    
    url = f"https://api.the-odds-api.com/v4/sports/{sport_key}/odds/"
    params = {
        'apiKey': config['odds_api_key'],
        'regions': 'uk',

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The odds request forces the region parameter to 'uk', which imposes a locale-specific behavior without offering user selection or documenting a justified regional constraint. This matches the language/locale policy concern for hard-coded locale behavior without opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/betting_research.py (reported line 131)May include surrounding context.

python

except:
        date_str = datetime.now().strftime('%Y-%m-%d')
    
    url = f"https://api.open-meteo.com/v1/forecast"
    params = {
        'latitude': lat,
        'longitude': lon,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill claims to be a betting research aggregator but also executes an external search tool, which materially increases capability beyond straightforward HTTP data retrieval. In a skill ecosystem, hidden or unnecessary execution capabilities are dangerous because they enlarge the attack surface and make it easier for a compromised dependency to run code locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill triggers an external search subprocess without clearly telling the user that another local tool will be executed and that their query will be passed into it. Lack of disclosure is especially risky here because the downstream script may itself make additional network requests or handle data in ways not visible in this file.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 90% confidence

Finding

The code executes a local Node.js script via subprocess using data derived from the user query. Although it avoids shell=True and passes arguments as a list, it still expands the skill's capabilities to arbitrary external program execution and trusts a script located in the user's home workspace, which could be replaced or modified by another local process.

Content

Scanner excerpt · scripts/betting_research.py (reported line 220)May include surrounding context.

python

search_script = Path.home() / ".openclaw" / "workspace" / "skills" / "search-x" / "scripts" / "search.js"
        if search_script.exists():
            query = f"{home_team} vs {away_team} lineup"
            result = subprocess.run(
                ["node", str(search_script), query, "--compact"],
                capture_output=True,
                text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 90% confidence

Finding

This subprocess invocation has the same risk profile as the lineup search: it launches an external Node.js script using user-influenced input and a mutable script path under the home directory. That creates a trust-boundary violation and allows the skill to execute code outside the reviewed Python implementation.

Content

Scanner excerpt · scripts/betting_research.py (reported line 239)May include surrounding context.

python

search_script = Path.home() / ".openclaw" / "workspace" / "skills" / "search-x" / "scripts" / "search.js"
        if search_script.exists():
            query = f"{team_name} injury news"
            result = subprocess.run(
                ["node", str(search_script), query, "--compact"],
                capture_output=True,
                text=True,

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The closing tip actively instructs users to use '--full' for confirmed lineups, injuries, and xG. That directly contradicts the implementation, which only reads sys.argv[1] as a query and contains no '--full' branch or API-Football integration, making this a clear intent-code divergence.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file loads an API-Football key and defines an API-Football base URL, and later tells users to run with '--full' for API-Football data including confirmed lineups, injuries, and xG. In reality, there is no '--full' handling and no API-Football requests anywhere, so the documented/advertised behavior does not match the actual implementation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest only describes betting research functionality and does not mention local credential discovery. Accessing environment variables and files under ~/.config to obtain API keys extends the skill into local secret/config harvesting behavior, which is not directly expressed in its purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.