NBA Tracker

提供NBA球队和球员赛程、实时比分及关键时刻提醒，支持追踪球员伤病和自动添加比赛到日历，适合观赛辅助。

This skill appears to be what it claims: an nba_api-based viewer for schedules, scores, injuries and simple alerts. Before installing or running it: 1) review/trim the truncated calendar example — any use of subprocess or system calls to modify calendars can run shell commands on your machine, so only run that part if you trust the code and understand the commands; 2) test the included script in a sandbox or non-production environment (there are some coding inconsistencies/typos that could raise exceptions); 3) since the skill uses live NBA endpoints, expect network requests and rate limits; 4) no credentials are required, which reduces risk, but always inspect third-party example code (especially anything that spawns subprocesses or writes to system calendars) before use.

Type: OpenClaw Skill Name: nba-tracker Version: 1.0.3 The skill bundle is classified as suspicious due to the inclusion of code in SKILL.md that uses subprocess.run to execute osascript for macOS Calendar integration. This implementation is vulnerable to AppleScript injection because it embeds unsanitized variables (such as player names and matchups) directly into a script string. While this functionality aligns with the stated purpose of adding games to a calendar, the use of shell-level execution for system automation is a high-risk capability that could be exploited if the agent processes malicious input.