Football Predictor

• Outcome: Review
• Latest audit: May 29, 2026 · 9:23 PM UTC
• Version: 1.0.0

Overview

This skill is not clear malware, but it needs Review because it presents betting predictions from mostly random mock data and includes under-disclosed persistence, broad tools, and optional external sharing.

Install only for experimentation. Do not use its recommendations for real betting or financial decisions unless the publisher adds verified live data sources, labels mock mode clearly, narrows tool permissions, documents environment variables, and provides explicit controls for memory, scheduling, and EvoMap sharing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: This module is presented as automatically collecting and tracking football match data, but most of the returned values are fabricated via Math.random() rather than sourced from real providers. In a betting-prediction skill, silently substituting mock data can mislead users into treating invented odds, team form, and results as factual analysis, creating material decision risk and deceptive behavior.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The comments claim optional API-backed collection, but the football API path is stubbed to always return null, guaranteeing fallback to mock odds. This creates a deceptive reliability gap between advertised capability and actual behavior, which is especially risky in a sports prediction and betting-advice context where users may rely on supposed real-time data.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This module introduces an unrelated external knowledge-sharing channel into a football prediction skill and is configured via hub/node credentials from the environment. Even if intended for telemetry or collaboration, it expands the trust boundary and creates a covert data egress path for prompts, predictions, or derived user data to a third-party service without clear necessity for the core skill.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The auto-trigger condition is broad enough to activate on common football, betting, or analysis-related requests, which can cause the skill to run unexpectedly. In a skill with execution, messaging, persistence, and possible remote-network behaviors, accidental triggering increases the chance of unintended data collection, storage, or outbound actions without clear user intent.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill documents persistent memory files and external knowledge-network access but does not warn users that their queries, predictions, or derived data may be stored or transmitted. Even if the data is not highly sensitive by default, betting-related behavior and historical usage can reveal preferences, financial intent, or other personal patterns, making undisclosed retention and sharing a meaningful privacy issue.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The fetch path sends node identity and arbitrary signals to a remote service with no evidence of consent, disclosure, or data minimization. In a prediction skill, signals may contain user queries, betting interests, or internal analytics, so this creates a privacy and data-governance risk through external transmission.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The heartbeat mechanism continuously reports capabilities and operational stats to a remote service without user-facing disclosure. This leaks metadata about deployment behavior and system usage, which can aid profiling of the agent environment and expose business-sensitive telemetry even if no direct user content is sent.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.13.6"
  }
}

• Confidence: 84% confidence
• Finding: "axios": "^1.13.6"

Known Vulnerable Dependency: axios==1.13.6 — 10 advisory(ies): CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF); CVE-2026-42044 (Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `pars); CVE-2026-42037 (Axios: CRLF Injection in multipart/form-data body via unsanitized blob.type in f) +7 more

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: axios==1.13.6

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.