Sharp Line Detector

Monitor line movements at sharp sportsbooks (Pinnacle, Circa, Bookmaker). Detect steam moves, reverse line movement, and significant implied probability shif...

This skill appears to do what it claims: call The Odds API, parse odds, and save snapshots. Before installing: 1) Confirm you will provide an ODDS_API_KEY (the SKILL.md expects this) and that the registry metadata is updated to reflect that requirement. 2) Consider setting SHARP_SNAPSHOT_DIR to a location you control (not world-writable) if you care about where files land. 3) The SKILL.md lists python3 as required but the sample uses only curl and jq—ask the publisher why python3 is required. 4) Verify you trust the skill owner (no homepage/source is included in the registry metadata). 5) Limit the API key scope/permissions where possible and rotate the key if you later remove the skill.

Type: OpenClaw Skill Name: sharp-line-detector Version: 1.1.0 The skill contains a shell injection vulnerability in the SKILL.md file within the 'Snapshot Current Lines' operation. The environment variable SPORT_KEY is expanded directly into a shell command and a jq filter string without proper sanitization or the use of safe argument passing (e.g., jq --arg), which could allow for arbitrary command execution if the variable is manipulated. While the skill's logic is aligned with its stated purpose of tracking sports betting odds via The Odds API, this lack of input validation constitutes a high-risk security flaw.