Odds Movement Monitor 盘口监控

盘口变化监控助手 - 实时监控足球、篮球等体育赛事的亚盘、欧赔、大小球盘口变化。检测异常波动、大额注单信号、机构态度转变。支持多平台对比、历史趋势分析、自动预警通知。当用户需要监控盘口变化、追踪赔率走势、发现投注机会时使用。

This skill implements an odds-monitoring tool and also includes a built-in billing integration that attempts to charge 0.01 USDT per call. Two issues to consider before installing or running it: 1) Hard-coded billing key: payment.py contains a long hard-coded BILLING_API_KEY. That is unusual and risky — it may expose the publisher's secret, allow unexpected behavior, or indicate sloppy credential handling. Ask the publisher why a secret is embedded, and request they remove it and rely on environment variables (and rotate the key if it's real). 2) Conflicting metadata: _meta.json says SkillPay credentials are required but the registry metadata listed none. README and code reference ODDS_API_KEY for fetching odds; confirm which env vars you must supply and whether billing is mandatory. Do not provide payment credentials (or your wallet) until you verify the billing provider (skillpay.me) is legitimate. Other practical recommendations: - Review payment.py and test it in a safe sandbox (no real credentials) to see what it calls. - If you proceed, run the skill in an isolated environment and monitor outbound network traffic and file writes. - Consider asking the author to remove hard-coded keys and to document billing flow clearly (how user_id is used, where payments go, whether charges are reversible). - Be aware this tool is for gambling-related monitoring — ensure that using it is lawful in your jurisdiction. Given these inconsistencies and the embedded secret, I recommend caution (suspicious) until the author clarifies and fixes the billing/credential handling.

Type: OpenClaw Skill Name: shenmeng-odds-monitor-2025 Version: 1.0.0 The skill implements a sports betting monitor with a mandatory pay-per-use billing system integrated via `payment.py`. This file contains a hardcoded API key (`sk_f03aa8f8bbcf79f7aa11c112d904780f22e62add1464e3c41a79600a451eb1d2`) and communicates with an external service (`skillpay.me`) to charge users in USDT. While the monetization is disclosed in `SKILL.md`, the hardcoded credential is a significant security vulnerability, and the mandatory network-based billing check represents a high-risk behavior for an AI agent skill.