EdgeBets
v1.0.4AI-powered sports betting simulations with Monte Carlo analysis
0· 84·0 当前·0 累计
by 安全扫描
OpenClaw
可疑
medium confidenceThe skill mostly matches its stated purpose (sports betting simulations) but asks for a full Solana private key as an environment variable and has several metadata/information inconsistencies that warrant caution before installing.
评估建议
This SDK appears to be a legitimate sports-simulation client that charges a small USDC fee on Solana. However, it requires a full Solana private key (SOLANA_PRIVATE_KEY) which would allow any code in the SDK to spend funds from that wallet. Before installing or providing a private key:
- Do NOT supply your primary/high-value wallet private key. Use a dedicated wallet funded only with the small amount you are willing to risk for simulations.
- Verify the treasury address (TREASURY_WALLET) and ...详细分析 ▾
ℹ 用途与能力
The name/description (Monte Carlo sports betting with Solana/x402 payments) aligns with the code and SKILL.md: the SDK includes payment and simulation services and calls to an EdgeBets API. Requesting a Solana private key is consistent with an SDK that must sign Solana payments, but the registry metadata marks no primary credential while SKILL.md declares SOLANA_PRIVATE_KEY — this mismatch is unexpected.
ℹ 指令范围
SKILL.md explicitly instructs the agent to set SOLANA_PRIVATE_KEY and use the SDK to fetch games and initiate paid simulations; it does not instruct reading arbitrary system files or exfiltrating unrelated data. README examples also show reading a local wallet file (e.g., ~/.config/solana/id.json) — this is example code but increases the chance the SDK will be used to load private keys from disk if users follow examples.
✓ 安装机制
There is no external download/install spec; full SDK source is included in the package (package.json, dist/, src/). Dependencies are standard (@solana/web3.js, @solana/spl-token). No suspicious remote install URLs or archive extraction were found.
⚠ 凭证需求
The skill requires SOLANA_PRIVATE_KEY (a full wallet secret) which grants unrestricted access to funds in that wallet. That is functionally required to perform automated Solana payments, but it is highly sensitive and should be treated with caution. Additionally, the registry metadata lists no primary credential while SKILL.md requires SOLANA_PRIVATE_KEY — an inconsistency that reduces clarity about the skill's intended secret handling.
✓ 持久化与权限
Skill does not request always:true and does not appear to modify other skills or system settings. Autonomous invocation is allowed (platform default) but not combined with other high-risk flags.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.42026/3/30
Updated pricing to $1.00 per simulation
● 无害
安装命令 点击复制
官方npx clawhub@latest install edgebets
镜像加速npx clawhub@latest install edgebets --registry https://cn.clawhub-mirror.com
数据来源：ClawHub ↗ · 中文优化：龙虾技能库
OpenClaw 技能定制 / 插件定制 / 私有工作流定制
免费技能或插件可能存在安全风险，如需更匹配、更安全的方案，建议联系付费定制