📦 Sports Betting — 链上体育竞猜
v1.3.1通过 Pinwin 与 Azuro 在去中心化链上投注与结算，实时赔率、高流动性、无需托管，可抓取赛前与滚球数据。
0· 1.0k·3 当前·3 累计
by 下载技能包
最后更新
2026/4/22
安全扫描
OpenClaw
安全
high confidenceNULL
评估建议
This skill appears internally consistent and implements the expected flow for on‑chain betting. Before installing: 1) Only use a dedicated wallet/private key with limited funds — the skill will sign real transactions with BETTOR_PRIVATE_KEY. 2) Review and verify the contract addresses and API hosts (Pinwin, Azuro/onchainfeed) in the constants; mismatch could indicate tampering. 3) Be aware scripts log decoded payloads and request bodies (which may contain betting details); avoid running where lo...详细分析 ▾
✓ 用途与能力
The skill's name/description (Pinwin/Azuro on Polygon) match the actual code and network endpoints. Requesting a wallet private key (BETTOR_PRIVATE_KEY) and Node is expected for signing and broadcasting EIP-712 transactions. Declared constants (token, contract addresses, RPC, Pinwin/API endpoints) are directly used by the scripts.
ℹ 指令范围
Runtime instructions are narrow and focused: fetch games, prepare payloads, require explicit user confirmation before any signing/sending, and query subgraphs for status. The SKILL.md contains explicit safety rules (one confirmation per bet, no autonomous retries) and the skill is invocation-only (disable-model-invocation: true). Note: scripts print request/decoded payloads and other debug info to console; those logs can expose bet details and should be considered when running in a shared/logged environment.
ℹ 安装机制
There is no packaged installer; the skill is instruction-only but includes package.json and package-lock.json. It expects the user to run npm install (viem, @azuro-org/dictionaries, dotenv). These are public npm packages (registry.npmjs.org) — standard but carries the usual npm supply-chain risk; no obscure download URLs or extracted archives are used.
ℹ 凭证需求
Only one high-sensitivity env var is required: BETTOR_PRIVATE_KEY (declared as primaryEnv). That is proportional to the purpose (signing blockchain transactions). The SKILL.md recommends storing the key in a .env file under the skill workspace with chmod 600; this is reasonable but still means the agent environment will have direct access to the private key. Consider using a dedicated betting wallet with limited funds.
✓ 持久化与权限
The skill is not always-enabled, does not request system-wide config changes, and is invocation-only (disable-model-invocation true). It does not modify other skills’ configs. No elevated persistence privileges are requested.
⚠ scripts/place-bet.js:386
Shell command execution detected (child_process).
⚠ scripts/claim-bets.js:36
Environment variable access combined with network send.
⚠ scripts/place-bet.js:52
Environment variable access combined with network send.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.3.12026/2/19
NULL
● 无害
安装命令
点击复制官方npx clawhub@latest install sports-betting
镜像加速npx clawhub@latest install sports-betting --registry https://cn.longxiaskill.com