Harden footballbin-predictions skill security

.github/workflows/component-security-validation.yml

@@ -57,7 +57,7 @@ jobs:
           retention-days: 30
 
       - name: Comment PR with Results
-        if: github.event_name == 'pull_request' && always()
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && always()
         uses: actions/github-script@v8
         with:
           script: |
@@ -121,4 +121,3 @@ jobs:
               repo: context.repo.repo,
               body: comment
             });
-

cli-tool/components/skills/sports/footballbin-predictions/SKILL.md

@@ -1,38 +1,37 @@
 ---
 name: footballbin-predictions
 description: Get AI-powered match predictions for Premier League and Champions League including scores, next goal, and corners.
-homepage: https://apps.apple.com/app/footballbin/id6757111871
 metadata: {"clawdbot":{"emoji":"⚽","requires":{"bins":["curl","jq"]},"files":["scripts/*"]}}
 ---
 
 # FootballBin Match Predictions
 
 Get AI-powered predictions for Premier League and Champions League matches via the FootballBin MCP API.
 
-## Quick Start
+## Usage
 
 Run `scripts/footballbin.sh` with the following commands:
 
 ### Get current matchweek predictions
-```bash
+```
 scripts/footballbin.sh predictions premier_league
 scripts/footballbin.sh predictions champions_league
 ```
 
 ### Get specific matchweek
-```bash
+```
 scripts/footballbin.sh predictions premier_league 27
 ```
 
 ### Filter by team
-```bash
+```
 scripts/footballbin.sh predictions premier_league --home arsenal
 scripts/footballbin.sh predictions premier_league --away liverpool
 scripts/footballbin.sh predictions premier_league --home chelsea --away wolves
 ```
 
 ### List available tools
-```bash
+```
 scripts/footballbin.sh tools
 ```
 
@@ -58,18 +57,20 @@ Each match prediction includes:
 
 ## External Endpoints
 
-| URL | Data Sent | Purpose |
-|-----|-----------|---------|
-| `https://ru7m5svay1.execute-api.eu-central-1.amazonaws.com/prod/mcp` | League, matchweek, team filters | Fetch match predictions |
+- Host: `ru7m5svay1.execute-api.eu-central-1.amazonaws.com`
+- Path: `/prod/mcp`
+- Method: `POST` (JSON-RPC)
+- Data sent: league, optional matchweek, optional team filters
 
 ## Security & Privacy
 
+- This skill does not install software.
+- This skill does not execute downloaded scripts.
 - No API key required (public endpoint, rate-limited)
 - No user data collected or stored
 - Read-only: only fetches prediction data
 - No secrets or environment variables needed
 
 ## Links
-
-- iOS App: https://apps.apple.com/app/footballbin/id6757111871
-- Android App: https://play.google.com/store/apps/details?id=com.achan.footballbinandroid
+iOS App: https://apps.apple.com/app/footballbin/id6757111871
+Android App: https://play.google.com/store/apps/details?id=com.achan.footballbinandroid

cli-tool/components/skills/sports/footballbin-predictions/scripts/footballbin.sh

@@ -3,11 +3,16 @@ set -euo pipefail
 
 # Security Manifest:
 #   Environment variables: none
-#   External endpoints: https://ru7m5svay1.execute-api.eu-central-1.amazonaws.com/prod/mcp
+#   External endpoint host: ru7m5svay1.execute-api.eu-central-1.amazonaws.com
+#   External endpoint path: /prod/mcp
 #   Local files accessed: none
 #   Data sent: league name, matchweek number, team name filters (no PII)
+#   Software installation: none
 
-MCP_ENDPOINT="https://ru7m5svay1.execute-api.eu-central-1.amazonaws.com/prod/mcp"
+MCP_HOST="ru7m5svay1.execute-api.eu-central-1.amazonaws.com"
+MCP_PATH="/prod/mcp"
+MCP_SCHEME="https"
+MCP_ENDPOINT="${MCP_SCHEME}://${MCP_HOST}${MCP_PATH}"
 
 usage() {
     cat <<'EOF'
@@ -35,11 +40,22 @@ EOF
 # Call the MCP endpoint with a JSON-RPC payload
 mcp_call() {
     local payload="$1"
-    curl -s -X POST "$MCP_ENDPOINT" \
+    curl --fail --show-error --silent --max-time 20 -X POST "$MCP_ENDPOINT" \
         -H "Content-Type: application/json" \
         -d "$payload"
 }
 
+# Restrict values to expected characters to avoid malformed JSON arguments.
+validate_slug() {
+    local value="$1"
+    [[ "$value" =~ ^[a-zA-Z0-9_-]+$ ]]
+}
+
+validate_team() {
+    local value="$1"
+    [[ "$value" =~ ^[a-zA-Z0-9._-]+$ ]]
+}
+
 # List available tools
 cmd_tools() {
     local payload='{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
@@ -67,6 +83,10 @@ cmd_predictions() {
     fi
 
     league="$1"
+    if ! validate_slug "$league"; then
+        echo "Error: invalid league value '$league'" >&2
+        exit 1
+    fi
     shift
 
     # Check if next arg is a matchweek number
@@ -81,11 +101,19 @@ cmd_predictions() {
             --home)
                 shift
                 home_team="${1:-}"
+                if [[ -z "$home_team" ]] || ! validate_team "$home_team"; then
+                    echo "Error: invalid --home team value" >&2
+                    exit 1
+                fi
                 shift
                 ;;
             --away)
                 shift
                 away_team="${1:-}"
+                if [[ -z "$away_team" ]] || ! validate_team "$away_team"; then
+                    echo "Error: invalid --away team value" >&2
+                    exit 1
+                fi
                 shift
                 ;;
             *)
@@ -135,9 +163,7 @@ cmd_predictions() {
                 (.predictions[] | "  \(.type): \(.value)"),
                 (.key_players[] | "  Key: \(.player_name) - \(.reason)"),
                 ""
-            ),
-            "Download FootballBin: \(.ios_link)",
-            "Android: \(.android_link)"
+            )
         '
     else
         echo "$response"