Odds Movement Monitor 盘口监控

盘口变化监控助手 - 实时监控足球、篮球等体育赛事的亚盘、欧赔、大小球盘口变化。检测异常波动、大额注单信号、机构态度转变。支持多平台对比、历史趋势分析、自动预警通知。当用户需要监控盘口变化、追踪赔率走势、发现投注机会时使用。

This skill implements the advertised odds-monitoring features, but it embeds a hard-coded SkillPay API key in payment.py and has inconsistent environment/metadata declarations. Risks: (1) the embedded billing key is sensitive — if valid it can be abused or leaked; (2) the skill will call an external billing endpoint and attempt to charge users automatically, which is not fully documented in SKILL.md; (3) registry metadata and files disagree about which env vars are required. Before installing or running: - Do NOT run this on any machine with sensitive credentials or on production agents until the author fixes the issues. - Ask the author to remove the hard-coded BILLING_API_KEY from source and require SKILLPAY_API_KEY be provided via environment/config; verify they rotate the exposed key if it has been published. - Request clear documentation on how SKILLPAY_USER_ID is supplied and whether billing calls occur automatically on each invocation. - Consider running the skill in an isolated environment (sandbox/container) and monitor outbound network calls to skillpay.me and api.the-odds-api.com. - If you do not trust the billing provider or the author, do not install — you could be charged unexpectedly or expose the embedded key. If you want, I can: (a) point to the exact lines containing the embedded key and the billing calls, (b) suggest a minimal patch to require SKILLPAY_API_KEY from env, or (c) produce instructions to run the code in a network-restricted sandbox for audit.

Type: OpenClaw Skill Name: shenmeng-odds-monitor-v3 Version: 1.0.0 The skill bundle implements a sports betting odds monitor but includes a non-standard monetization layer in 'payment.py' that integrates with an external service (skillpay.me). This file contains a hardcoded secret API key (sk_f03aa8...) and logic to automatically deduct funds from a user's account based on the 'SKILLPAY_USER_ID' environment variable. While the payment requirement is documented in 'SKILL.md', the presence of hardcoded credentials and automated financial transaction logic represents a significant security risk and atypical behavior for a skill bundle.