lotto-agent
Analysis
This appears to be a coherent private lottery assistant, with notable but disclosed local storage, optional API-key use, and confirmable cron-based automation.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
当用户提到：彩票、双色球、大乐透、七星彩、七乐彩、福彩3D、排列三、排列五、快乐8、选号、开奖、兑奖、中奖、期号、奖池、奖金、报告、盈亏、推荐号码，必须优先使用此 Skill。
The skill defines a broad set of lottery-related triggers and says it must be prioritized. This is aligned with the stated purpose, but users should know it may be invoked for many lottery-adjacent requests.
pytest>=8.0.0
The README recommends installing requirements, and this dependency is specified as a version range rather than an exact pinned version. It is user-directed setup and not evidence of malicious behavior.
return f"*/5 * * * * cd {shell_quote(skill_dir)} && {python_bin} scripts/main.py schedule --push {CRON_MARKER}"The skill can create a cron entry that wakes the skill every five minutes for automation. The code and README indicate this requires confirmation and has an uninstall path, so it is disclosed persistence rather than hidden behavior.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
appkey = env(source_config.get("appkey_env", "JISU_APPKEY"))The skill can use an API key for a draw-data provider when configured. This is consistent with fetching lottery draw data and the README says the default public GitHub source does not require ordinary installers to configure an API key.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
DB_PATH = DATA_DIR / "lottery.db"
The skill stores lottery tickets, draw data, prize results, reports, settings, and scheduled tasks in a local SQLite database. This is expected for tracking costs and prize checks, but it is persistent local user data.