World Cup and Football Predictor

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:12 AM UTC
• Version: 1.2.0

Overview

This skill is a local football forecasting and review tool with disclosed local record keeping and model-profile controls, not an exfiltration or system-tampering package.

Installers should treat this as a betting-adjacent forecasting aid, not a guarantee. Use a dedicated data directory if you do not want match inputs mixed with other files, use --no-record when you do not want local ledgers, and only run promote or rollback when you intend to change the local active model profile.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (37)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broad football prediction skill handling forecasts, alerts, post-match review, and many betting-market inputs. This code chunk is narrowly focused on offline model governance: validating archived completed records, replaying forecasts, computing evaluation metrics, generating challenger parameter tweaks, deciding promotion gates, rolling back underperformance, and persisting audit/evolution artifacts. The only strong overlap is the declared 'controlled self-evolution' / '模型进化' aspect. Because the description’s primary emphasis is a general football forecasting/odds-analysis skill while the supplied code is specifically an evolution script without forecast-serving, odds ingestion, or alerting behavior, the description does not accurately represent what this chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description presents a user-facing football forecasting/analysis skill covering odds, line movement, score prediction, review, and model evolution. This code chunk does not perform forecasting, ingest bookmaker odds, analyze markets, issue alerts, or review matches. Instead, it is an internal model-profile management module: it validates configuration schemas, constrains parameter changes, verifies evolution evidence via SHA-256 fingerprint, and manages active profiles on disk with locking and rollback. While 'controlled self-evolution' is loosely related, the primary behavior here is configuration/profile governance, not football forecasting or betting-market analysis. Therefore the declared description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad football prediction and review skill with substantial betting-market analysis and model evolution capabilities. The supplied code chunk is much narrower: it builds post-match wakeup alerts based on kickoff time and match type, adds bounded retry schedules, and emits a prompt instructing another tool/script to perform review later. Its primary purpose is scheduling/alert generation, not forecasting, odds analysis, or self-evolution. While 'post-match alerts' are mentioned in the description, the code lacks most of the declared core capabilities, so the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broad football forecasting and odds-analysis capability, including multiple betting-market formats, pre-kickoff alerts, post-match review, and model evolution. The actual code chunk does not implement those analytical behaviors. It is only a test file validating a command-line kickoff alert generator: input parsing, chronological sorting, timezone conversion, DST correctness, and error handling. While 'pre-kickoff alerts' is one item mentioned in the description, the concrete behavior here is limited to scheduling alert times, not producing football forecasts or odds-based insights. The test assertions also indicate the generated prompt should invoke a different predictor skill rather than the declared odds forecaster, which further suggests a description/behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description presents a broad football prediction/review skill with betting-market analysis (1X2, Asian handicap, totals, BTTS, exact score, etc.) and controlled self-evolution. The actual code chunk does not implement those capabilities. Instead, it only tests a helper script that schedules post-match alerts at fixed offsets from kickoff, generates bounded retries, enforces timezone-aware timestamps, handles DST transitions, checks final-status completion rules, and verifies the CLI fails cleanly on invalid inputs. While post-match alerts are mentioned in the declared purpose, the actual chunk is narrowly focused on alert scheduling mechanics and prompt validation, not forecasting, odds analysis, match review generation, or model evolution. That is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md

python3 scripts/forecast.py --input examples/multi-book-match.json --data-dir ~/.football-forecaster --pretty

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

md

python3 scripts/forecast.py --input examples/multi-book-match.json --data-dir ~/.football-forecaster --pretty

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_forecast.py (reported line 1723)May include surrounding context.

python

def test_cli_uses_default_data_dir_and_record_out_takes_precedence(self):
        with tempfile.TemporaryDirectory() as tmpdir:
            default_dir = Path(tmpdir) / "default"
            environment = {**os.environ, "FOOTBALL_FORECASTER_DATA_DIR": str(default_dir)}
            base_command = [
                sys.executable,
                str(ROOT / "scripts" / "forecast.py"),

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_forecast.py (reported line 1749)May include surrounding context.

python

def test_cli_no_record_disables_default_ledger(self):
        with tempfile.TemporaryDirectory() as tmpdir:
            environment = {**os.environ, "FOOTBALL_FORECASTER_DATA_DIR": tmpdir}
            result = subprocess.run(
                [
                    sys.executable,

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises and invokes executable capabilities via shell commands and references to scripts, while omitting any explicit tool-scope declaration such as allowed-tools or permissions. That creates an overbroad execution surface where the agent may read/write files or run commands without least-privilege constraints, increasing the chance of prompt-driven misuse, unintended filesystem modification, or unauthorized command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The rollback branch immediately calls model_profile.rollback_profile(...) and returns the rolled-back profile ID, but there is no confirmation prompt, warning print, or other user disclosure before this potentially destructive state change. Because rollback changes the active profile and may be hard to undo, this qualifies as a safety-relevant operation lacking an in-code warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

When promotion succeeds, the code finalizes a candidate profile, writes JSON artifacts, and activates the new profile with model_profile.activate_profile(...) without any confirmation prompt or explicit warning in the code path. Although promotion is part of the tool's purpose, the state-changing file writes and activation occur silently from the user's perspective aside from final JSON output.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The forecast record embeds the full raw match input and full profile snapshot, which can persist more data than needed for forecasting output. If inputs contain sensitive bookmaker data, internal annotations, or operational metadata, this creates an unnecessary data retention surface and increases the blast radius of any local file disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This Python file includes user-facing natural-language risk messages in Chinese, while the rest of the script and CLI are in English. That forces a specific output language for part of the skill behavior without offering the user a language or locale choice, which matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a skill for football forecasts, alerts, reviews, and model evolution, but this file also performs local stateful record-keeping by writing forecast outputs to a ledger file. Persisting records is not merely computation of forecasts; it introduces storage side effects that are not stated in the manifest description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The review builder rejects any language other than "zh" or "en", which hard-codes a locale restriction into the skill's behavior. In this code file there is no natural-language justification that the skill is region-specific or that users are offered broader locale choice beyond those two options.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_calibrate.py (reported line 598)May include surrounding context.

python

with tempfile.TemporaryDirectory() as tmpdir:
            path = Path(tmpdir) / "completed.jsonl"
            path.write_text("\n".join(rows) + "\n", encoding="utf-8")
            result = subprocess.run(
                [sys.executable, str(ROOT / "scripts" / "calibrate.py"), "--input", str(path)],
                check=True,
                capture_output=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_calibrate.py (reported line 612)May include surrounding context.

python

def test_cli_missing_input_fails_without_traceback(self):
        with tempfile.TemporaryDirectory() as tmpdir:
            path = Path(tmpdir) / "missing.jsonl"
            result = subprocess.run(
                [sys.executable, str(ROOT / "scripts" / "calibrate.py"), "--input", str(path)],
                capture_output=True,
                text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_evolve.py (reported line 286)May include surrounding context.

python

completed_path = data_dir / "completed.jsonl"
            completed_path.write_text(json.dumps(self.make_completed_record()) + "\n", encoding="utf-8")

            result = subprocess.run(
                [
                    sys.executable,
                    str(ROOT / "scripts" / "evolve.py"),

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_evolve.py (reported line 315)May include surrounding context.

python

completed_path = data_dir / "completed.jsonl"
            completed_path.write_text(json.dumps(self.make_completed_record()) + "\n", encoding="utf-8")

            result = subprocess.run(
                [
                    sys.executable,
                    str(ROOT / "scripts" / "evolve.py"),

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_forecast.py (reported line 85)May include surrounding context.

python

class ForecastCliCompatibilityTests(unittest.TestCase):
    def test_legacy_cli_fixture_runs(self):
        result = subprocess.run(
            [
                sys.executable,
                str(ROOT / "scripts" / "forecast.py"),

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_forecast.py (reported line 1562)May include surrounding context.

python

class ForecastCliCompatibilityTests(unittest.TestCase):
    def test_legacy_cli_fixture_runs(self):
        result = subprocess.run(
            [
                sys.executable,
                str(ROOT / "scripts" / "forecast.py"),

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_forecast.py (reported line 1593)May include surrounding context.

python

temp_path = handle.name
        self.addCleanup(lambda: Path(temp_path).unlink(missing_ok=True))

        result = subprocess.run(
            [
                sys.executable,
                str(ROOT / "scripts" / "forecast.py"),

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

These tests confirm the skill supports persistent local forecast recording, including automatic ledger creation and replayable raw match storage, which expands the tool beyond transient analysis into data retention. In an agent-skill context, unnecessary persistence increases privacy, audit-surface, and tampering risk because potentially sensitive inputs and outputs may be written to disk by default.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_forecast.py (reported line 1711)May include surrounding context.

python

str(path),
            ]

            first = subprocess.run(command, check=True, capture_output=True, text=True)
            second = subprocess.run(command, check=True, capture_output=True, text=True)

            self.assertEqual(

Static analysis

No suspicious patterns detected.