Football Predictor
WarnAudited by ClawScan on May 10, 2026.
Overview
This skill needs review because it presents football betting predictions as data-driven while the included code largely uses random mock data and simulated results.
Install only if you understand this appears to be an experimental/demo predictor. Do not rely on it for real betting unless real data sources are implemented, outputs clearly show data provenance, credentials/network sharing are intentionally configured, and persistence or scheduling behavior is reviewed.
Findings (7)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user could believe the betting recommendations are based on real market and match data when they may be generated from random mock data.
The SKILL.md advertises automatic match/odds collection and betting recommendations, but the code falls back to simulated data and random results, without clearly surfacing that limitation in the user-facing prediction output.
async fetchFromFootballAPI(match, apiKey) { ... return null; // 暂时返回null使用模拟数据 ... } ... home_score: Math.floor(Math.random() * 4)Treat this as a demo unless real data sources are implemented and clearly labeled. The skill should disclose mock data in outputs and avoid monetary betting advice unless inputs are verified.
If granted, the agent has broader operational authority than simple text analysis requires.
The skill requests broad execution and session-spawning tools even though the instructions do not provide tight limits or a clear need for spawning other sessions.
allowed-tools: exec, message, sessions_spawn
Limit tool access to what is needed, and require explicit user approval before running commands or spawning sessions.
The skill may fail at runtime, and reviewers cannot verify the intended memory read/write behavior from the supplied artifacts.
The supplied file manifest does not include src/memory/system.js, so the persistence implementation is missing from review and the package may not run as provided.
const MemorySystem = require('./src/memory/system');Provide the missing memory module or remove the dependency, and include a clear install/runtime specification.
Users may not realize that setting these environment variables grants the skill authority to authenticate to an EvoMap/A2A service.
The code can use A2A credentials from environment variables, while the registry metadata declares no env vars or primary credential.
this.nodeId = process.env.A2A_NODE_ID; this.nodeSecret = process.env.A2A_NODE_SECRET;
Declare optional credentials and their scope in metadata and documentation, and only configure them when knowledge sharing is intended.
If enabled or called, prediction-related signals or stats may be sent to a third-party/peer network.
The included EvoMap client supports A2A-style fetch/heartbeat requests to an external hub, though the main prediction path does not appear to call these methods by default.
this.hubUrl = process.env.A2A_HUB_URL || 'https://evomap.ai'; ... const response = await this.request('/a2a/fetch', ...)Keep EvoMap sharing disabled unless needed, use a trusted HTTPS hub, and disclose exactly what data is sent.
Past predictions and model changes can influence future outputs and remain on disk until removed.
The skill intentionally persists prediction history, results, statistics, and model parameters for later learning.
memory/predictions.json ... memory/results.json ... memory/stats.json ... memory/model.json
Document retention and deletion behavior, keep memory scoped to the skill directory, and let users reset or inspect stored prediction history.
If someone enables the scheduler, the skill could keep generating recommendations or learning updates in the background.
The scheduler can run recurring tasks every 10 minutes by default if start() is invoked; the provided main entry point does not appear to start it automatically.
checkFrequency = 'frequent' ... this.timers.main = setInterval(() => { this.run(); }, interval);Only start the scheduler after explicit user opt-in, and provide clear stop/cleanup instructions.