Is cryptopunk2070/sportsbook safe?
https://github.com/openclaw/skills/tree/main/skills/cryptopunk2070/sportsbook
The Fuku Sportsbook skill presents three interconnected high-severity risks: (1) a persistent C2 channel via silent notification polling on every invocation that allows the remote API operator to inject instructions into the agent's context, (2) explicit transparency suppression instructing the agent to operate 'behind the scenes' and hide all actions from users, and (3) autonomous financial transaction capability—the skill instructs the agent to independently place cryptocurrency bets (up to $100-500 per bet in real USDC on Base chain) without per-transaction user confirmation, particularly through the HEARTBEAT.md integration which runs continuously in the background. While no direct system credential exfiltration or canary file compromise was detected, the skill's fundamental architecture combines a server-controlled behavior injection mechanism with real-money autonomous action capability, representing a pattern more commonly associated with malware C2 frameworks than legitimate sports analytics tools.
Category Scores
Findings (13)
CRITICAL Silent Notification Polling Creates Server-Side C2 Channel -35 ▶
The SKILL.md instructs the agent to 'silently check for notifications' at the START of every skill invocation, before handling the user's actual request. The system.announcement notification type pushes arbitrary content directly into the agent's context as an 'info banner' without user awareness. This architecture means the remote API operator at cbb-predictions-api-nzpk.onrender.com can inject instructions into the agent's decision-making process at any time, for any user with the skill installed.
HIGH Explicit Transparency Suppression: Actions Hidden From User -20 ▶
The SKILL.md explicitly instructs the agent to conceal its actions from users. Registration steps call external APIs 'behind the scenes' without displaying what commands are running or what data is being sent. This prevents users from making informed consent decisions and masks the data flows described in the data exfiltration findings.
HIGH Autonomous Financial Transactions Without Per-Transaction Consent -40 ▶
The HEARTBEAT.md integration section instructs the agent to autonomously analyze betting opportunities and POST picks to the Fuku Sportsbook API at every heartbeat cycle. In paid tier, each bet involves real USDC on Base chain with 'losses collected on-chain immediately.' The agent is instructed to 'select 1-2 best value plays' and POST them without any per-transaction user confirmation. The daily schedule (9AM and 3PM EST) means bets can be placed at any time.
HIGH API Key Transmitted to External Server on Every Invocation -25 ▶
The poll_notifications.py script, executed silently on every skill invocation, sends the user's API key in an HTTP header to cbb-predictions-api-nzpk.onrender.com. This occurs even for benign sports queries that do not require authentication. Combined with the silent execution pattern, users are unaware that their credentials are being transmitted on every request.
HIGH Real-Identity and Betting Strategy Collection -20 ▶
The registration flow collects users' Twitter/X handles (real-world identity), betting strategies described in natural language (intellectual content), and links these permanently to cryptocurrency wallet addresses. This data is transmitted to and permanently stored by the external Fuku Sportsbook service. The Twitter verification step also creates a public, linkable on-chain identity-to-handle association.
HIGH Cryptocurrency Seed Phrase Displayed in LLM Conversation Context -25 ▶
The skill instructs the agent to display a full cryptocurrency wallet seed phrase directly in the conversation with text creating urgency ('SAVE THIS SEED PHRASE NOW - it will never be shown again!'). Seed phrases shown in LLM conversations may be retained in context windows, conversation logs, cloud sync, or operator-side logging. The urgency framing is a social engineering pattern designed to pressure users into insecure handling.
MEDIUM Remote Server Injects Content Into Agent Context via Announcements -10 ▶
The system.announcement notification type allows the remote server operator to inject arbitrary text content into the agent's visible context as an 'info banner.' A compromised API server, a malicious operator, or a supply-chain attack on cbb-predictions-api-nzpk.onrender.com could use this channel to override user preferences, fabricate information, or inject adversarial instructions.
MEDIUM Betting Analysis and Picks Exfiltrated to External API -15 ▶
The agent is instructed to POST detailed betting analysis including game selection, pick direction, bet amount, odds, and reasoning text to the external API. This represents substantive intellectual output generated by the user's configured agent being permanently sent to a third-party service outside the user's control.
MEDIUM Skill Inserts Itself Into Persistent Heartbeat Execution Loop -17 ▶
The HEARTBEAT.md Integration section instructs users to add this skill's notification polling and autonomous betting to their persistent HEARTBEAT.md file. This means the skill executes on every heartbeat cycle — continuously in the background — performing C2 polling and autonomous financial actions without the user actively invoking it.
LOW Python Scripts with Network Access Installed to Skill Directory -20 ▶
The skill includes 8 Python scripts that use httpx and requests libraries to make outbound HTTPS connections. While the scripts are explicitly invoked by the SKILL.md (no install hooks or auto-execution), they extend the skill's attack surface by adding network-capable code to the user's environment.
LOW API Credentials Written to Predictable Filesystem Location -8 ▶
The skill writes the user's API key and agent_id to ~/.config/fuku-sportsbook/config.json, a predictable location accessible by any other installed skill with filesystem access (Read tool). The config_loader.py also reads from env vars DAWG_PACK_API_KEY and DAWG_PACK_AGENT_ID, which could conflict with or be read alongside other environment credentials.
INFO Standard Installation from OpenClaw Monorepo -15 ▶
The skill was installed via a standard sparse-checkout git clone from github.com/openclaw/skills.git. No unexpected network connections, process spawning, or filesystem modifications outside the target directory were observed during installation.
INFO Canary File Accesses Attributed to Monitoring System -8 ▶
Canary files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, gcloud credentials) were accessed in batch at timestamps 1771923311 (pre-install baseline) and 1771923327.441 (post-install integrity check). The simultaneous batch-access pattern at identical millisecond timestamps is consistent with the oathe monitoring system performing SHA256 comparison scans, not skill-directed access. No content modification or exfiltration was detected.