中文 EN

Scan Report

Scan New Files

✓ Low Risk — Risk Score 5/100
Last scan:1 day ago Rescan
5 /100
bracketsbot-skill
Generate, validate, and submit BracketsBot NCAA tournament brackets.
BracketsBot is a legitimate NCAA tournament bracket generation and submission CLI. All capabilities are declared in SKILL.md. No malicious behavior, credential harvesting, obfuscation, or supply chain risks found.
Skill Namebracketsbot-skill
Duration46.0s
Enginepi
✓
Safe to install
No action needed. The skill is safe to use as described.

Findings 2 items

Severity Finding Location
Low
Minor doc-to-code mismatch on filesystem writes Doc Mismatch
SKILL.md does not explicitly declare that the skill writes prediction output files to ./out/. While this is a benign feature, it should be documented.
Writes to ./out/model-bracket-output.json and ./out/model-walk-picks.json
→ Add a 'File Outputs' section to SKILL.md listing writable paths (./out/*).
 SKILL.md:1
Low
Environment variable access not declared Doc Mismatch
SKILL.md does not document that CLI commands pass through process.env (TOURNAMENT_FILE, TEAM_DATA_FILE, CHAIN_ID, etc.) to child scripts.
env: { ...process.env, ...env }
→ Document environment variable usage in SKILL.md or at minimum in CLI --help output.
 scripts/cli.mjs:30
ResourceDeclaredInferredStatusEvidence
Shell WRITE WRITE ✓ Aligned scripts/cli.mjs:14 — child_process.spawn for Node script execution
Filesystem READ READ+WRITE ✓ Aligned Writes to ./out/ directory for predictions and walk state
Network READ READ ✓ Aligned POST/PATCH/GET to https://brackets.bot/api/* only
Environment NONE READ ✓ Aligned process.env passed through to child scripts (TOURNAMENT_FILE, TEAM_DATA_FILE, et…
11 findings
🔗
Medium External URL 外部 URL
https://brackets.bot/?p=$
README.md:81
🔗
Medium External URL 外部 URL
https://www.sports-reference.com/cbb/seasons/men/2026-ratings.html
reference/2026-season-guide.md:67
🔗
Medium External URL 外部 URL
https://kenpom.com
reference/2026-season-guide.md:68
🔗
Medium External URL 外部 URL
https://barttorvik.com
reference/2026-season-guide.md:69
🔗
Medium External URL 外部 URL
https://www.espn.com/mens-college-basketball/bpi
reference/2026-season-guide.md:70
🔗
Medium External URL 外部 URL
https://json-schema.org/draft/2020-12/schema
schema/bracket-output.schema.json:2
🔗
Medium External URL 外部 URL
https://basedketball.xyz/schemas/bracketsbot/bracket-output.schema.json
schema/bracket-output.schema.json:3
🔗
Medium External URL 外部 URL
https://basedketball.xyz/schemas/bracketsbot/team-data.schema.json
schema/team-data.schema.json:3
🔗
Medium External URL 外部 URL
https://basedketball.xyz/schemas/bracketsbot/tournament.schema.json
schema/tournament.schema.json:3
🔗
Medium External URL 外部 URL
https://brackets.bot
scripts/cli.mjs:342
💰
Medium Wallet Address 加密货币钱包地址
0x8d9a08b06a64be28a3a7b5e5b820561a1876b655
scripts/prepare-submit-transaction.mjs:68

File Tree

26 files · 125.8 KB · 4598 lines
JavaScript 14f · 2113L JSON 6f · 1945L Markdown 5f · 527L Shell 1f · 13L
├─ ▾ 📁 data
│ └─ 📋 team-data.json JSON 812L · 17.7 KB
├─ ▾ 📁 examples
│ ├─ ▾ 📁 policies
│ │ └─ 📜 simple-rating-policy.mjs JavaScript 13L · 448 B
│ └─ ▾ 📁 wallet-submission
│ └─ 🔧 bankr-cli-submit.sh Shell 13L · 363 B
├─ ▾ 📁 reference
│ ├─ 📝 2026-season-guide.md Markdown 97L · 4.4 KB
│ ├─ 📋 tournament.json JSON 924L · 18.0 KB
│ ├─ 📝 WALK_STATE.md Markdown 94L · 2.2 KB
│ └─ 📝 WALLET_INTEGRATIONS.md Markdown 69L · 1.8 KB
├─ ▾ 📁 schema
│ ├─ 📋 bracket-output.schema.json JSON 64L · 1.5 KB
│ ├─ 📋 team-data.schema.json JSON 74L · 1.7 KB
│ └─ 📋 tournament.schema.json JSON 47L · 1.2 KB
├─ ▾ 📁 scripts
│ ├─ ▾ 📁 lib
│ │ └─ 📜 bracket-walk.mjs JavaScript 201L · 5.6 KB
│ ├─ 📜 build-example-team-data.mjs JavaScript 71L · 2.1 KB
│ ├─ 📜 build-season-guide.mjs JavaScript 128L · 4.5 KB
│ ├─ 📜 build-team-data.mjs JavaScript 157L · 5.4 KB
│ ├─ 📜 cli.mjs JavaScript 368L · 12.7 KB
│ ├─ 📜 generate-bracketsbot-bracket.mjs JavaScript 189L · 5.3 KB
│ ├─ 📜 prepare-submit-transaction.mjs JavaScript 172L · 5.1 KB
│ ├─ 📜 semantic-run.mjs JavaScript 136L · 3.7 KB
│ ├─ 📜 share-link.mjs JavaScript 123L · 3.8 KB
│ ├─ 📜 validate-bracketsbot.mjs JavaScript 237L · 7.1 KB
│ ├─ 📜 walk-apply-pick.mjs JavaScript 79L · 2.2 KB
│ ├─ 📜 walk-next-game.mjs JavaScript 106L · 2.8 KB
│ └─ 📜 walk-run-policy.mjs JavaScript 133L · 3.7 KB
├─ 📋 package.json JSON 24L · 657 B
├─ 📝 README.md Markdown 122L · 4.2 KB
└─ 📝 SKILL.md Markdown 145L · 7.9 KB

Dependencies 2 items

PackageVersionSourceKnown VulnsNotes
viem ^2.22.17 npm No Standard EVM library, version pinned to 2.x range
incur ^0.3.3 npm No CLI framework, minor version range

Security Positives

✓ No credential harvesting or API key theft observed
✓ No base64 encoding or obfuscation of commands
✓ No attempts to access sensitive paths (~/.ssh, ~/.aws, .env)
✓ No curl|bash or wget|sh remote script execution
✓ No reverse shell, C2, or data exfiltration
✓ No malicious dependencies in package.json (only viem and incur, both well-known)
✓ Dependencies use semver ranges but no known malicious packages present
✓ Network access is limited to a single declared API endpoint (brackets.bot)
✓ File I/O is scoped to ./out/ directory and reference/data directories
✓ Dynamic policy module import is declared in SKILL.md (walk-run-policy command)
✓ All shell usage is documented CLI fallback commands (pnpm run cli ...)