Sports Betting Analyzer

智能体育彩票分析助手 - 基于数据分析和简单机器学习的比赛预测辅助工具。支持NBA、足球世界杯等赛事分析，提供数据收集、基础统计、概率预测和投注建议。重点在于辅助决策，而非预测结果。

What to consider before installing: 1) Packaging inconsistency: The registry claims 'instruction-only' but the published bundle contains executable scripts and a full Python virtualenv (hundreds of third-party files). This is unusual — ask the publisher why a venv was bundled instead of listing dependencies and let you install them from trusted registries. 2) Inspect the code: Before running, review the scripts (analyze.py, data_collector.py, prediction_model.py, report_generator.py) for any network calls or hidden endpoints. The current MVP uses simulated data, but comments indicate future plans to connect to external APIs — those integrations could request credentials later. 3) Prompt-injection artifact: The SKILL.md contained unicode control characters in the static scan. View the SKILL.md file with a hex or raw viewer to ensure no invisible control characters or manipulative payloads are present. 4) Run in a sandbox: If you decide to try it, run the skill inside an isolated environment (container or VM) that has no access to your secrets, cloud credentials, or sensitive files. Do not run it on machines with active AWS/GCP credentials or developer tokens. 5) Replace the bundled venv: Prefer installing dependencies yourself (pip install -r requirements.txt) in a fresh virtualenv rather than using the shipped venv. That reduces risk from bundled third-party code. 6) Limit trust and use-case: The tool is for entertainment/analysis only and contains disclaimers. Do not use it to automate actual betting transactions without deeper audit and legal consideration. 7) If uncertain, decline: Because of the unexpected large vendored venv and the prompt-injection signal, treat this skill as untrusted until the author provides a clear explanation and a cleaner packaging (source repo, build/install instructions, and confirmation that no hidden control characters are used).

Type: OpenClaw Skill Name: sports-betting-analyzer Version: 1.0.0 The skill bundle is classified as suspicious primarily because it includes the entire source code of the 'numpy' library (hundreds of files) within the bundle's directory structure. This is highly irregular for OpenClaw skills, which should typically define dependencies in a requirements file rather than bundling library source code, as it creates a massive attack surface and is a common technique for hiding malicious logic. Furthermore, while the documentation in SKILL.md claims to perform real-time data collection and API monitoring, the actual implementation in scripts/data_collector.py uses purely simulated random data. The scripts/runner.sh also redundantly attempts to pip install numpy despite the source being present. While no explicit exfiltration or backdoor logic was found, the non-standard structure and discrepancy between stated and actual functionality warrant caution.