中文 EN
Start Review
Skill Trust Decision

odds-movement-monitor

合法体育博彩盘口监控工具，存在硬编码API密钥和供应链风险，无明显恶意行为但安全实践不佳

Install decision first Source: ClawHub Scanned: Apr 9, 2026
Files 10
Artifacts 4
Violations 0
Findings 3
Most direct threat evidence
High Credential Theft
硬编码Billing API密钥暴露

payment.py:12 包含硬编码的billing API密钥'sk_f03aa8f8bbcf79f7aa11c112d904780f22e62add1464e3c41a79600a451eb1d2'，该密钥可用于向skillpay.me发起计费请求，可能被滥用

payment.py:12

Why this conclusion was reached

2/4 dimensions flagged
Pass
Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Block
Hidden execution and egress

1 high-risk artifacts or egress signals were extracted.

Block
Attack chain and severe findings

The report includes 0 attack-chain steps and 1 severe findings.

Review
Dependencies and supply chain hygiene

2 dependency or supply-chain issues need attention.

What drove the risk score up

硬编码API密钥暴露 +20

payment.py:12 硬编码billing API密钥，可能被滥用进行未授权计费

依赖版本未锁定 +8

requirements.txt使用>=模糊版本，存在供应链风险

敏感文件标记 +5

config.json被标记为敏感文件，内容未完整检查

网络请求超出声明 +2

payment.py向skillpay.me发起计费请求，SKILL.md仅模糊提及

Most important evidence

High Credential Theft

硬编码Billing API密钥暴露

payment.py:12 包含硬编码的billing API密钥'sk_f03aa8f8bbcf79f7aa11c112d904780f22e62add1464e3c41a79600a451eb1d2'，该密钥可用于向skillpay.me发起计费请求，可能被滥用

payment.py:12
应使用环境变量SKILLPAY_API_KEY存储密钥，不应在代码中明文存储
Medium Supply Chain

依赖版本未锁定

requirements.txt使用>=模糊版本声明，aiohttp>=3.8.0和requests>=2.28.0可能在未来引入不兼容变更或安全漏洞

requirements.txt:1
应锁定精确版本号，如aiohttp==3.9.0
Low Doc Mismatch

付费功能声明不明确

SKILL.md仅提及'已接入SkillPay'但未明确说明计费机制的具体实现细节（API endpoint、密钥存储方式）

SKILL.md:1
建议在文档中明确说明计费流程和密钥管理方式

Declared capability vs actual capability

Filesystem Pass
Declared READ
→
Inferred WRITE
monitor.py:61 创建SQLite数据库存储赔率数据
Network Pass
Declared READ
→
Inferred WRITE
monitor.py:88 向the-odds-api.com获取赔率；payment.py:19 向skillpay.me发起计费请求
Shell Pass
Declared NONE
→
Inferred NONE
未发现subprocess或shell执行
Environment Pass
Declared NONE
→
Inferred READ
payment.py:18 读取SKILLPAY_USER_ID环境变量

Suspicious artifacts and egress

High API Key
API_KEY = "sk_f03aa8f8bbcf79f7aa11c112d904780f22e62add1464e3c41a79600a451eb1d2"

payment.py:12

Medium External URL
https://api.the-odds-api.com/v4

config.json:15

Medium External URL
https://the-odds-api.com/

monitor.py:527

Medium External URL
https://skillpay.me

payment.py:11

Dependencies and supply chain

PackageVersionSourceKnown vulnNotes
aiohttp >=3.8.0 pip No 无版本锁定
requests >=2.28.0 pip No 无版本锁定

File composition

10 files · 1745 lines
Python 5 files · 1432 linesMarkdown 2 files · 240 linesJSON 2 files · 71 linesText 1 files · 2 lines
Files of concern · 5
config.json JSON · 49 lines
https://api.the-odds-api.com/v4
monitor.py Python · 597 lines
https://the-odds-api.com/
payment.py Python · 142 lines
硬编码Billing API密钥暴露 · API_KEY = "sk_f03aa8f8bbcf79f7aa11c112d904780f22e62add1464e3c41a79600a451eb1d2" · https://skillpay.me
SKILL.md Markdown · 120 lines
付费功能声明不明确
requirements.txt Text · 2 lines
依赖版本未锁定
Other files · change_detector.py · demo.py · README.md · __init__.py · _meta.json

Security positives

核心功能代码结构清晰，无明显混淆
网络请求均有合理解释（赔率API + 计费验证）
未发现凭证收割、环境变量遍历等高危模式
未发现反向shell、C2通信等恶意行为
未发现base64管道、eval(atob())等执行混淆