mlb-statcast-player-comparison
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The
scripts/crawlora.shscript demonstrates high security awareness. It prevents API key exposure in process logs by using a temporarycurlconfiguration file with restricted permissions (chmod 600). It also implements a whitelist for allowed API paths and prevents local file disclosure by rejecting the '@' character in parameters, which is a knowncurlinjection vector.\n- [INDIRECT_PROMPT_INJECTION]: As the skill retrieves and processes statistics from the Crawlora API, it possesses a standard attack surface for indirect prompt injection.\n - Ingestion points: Data returned from the
/mlb/endpoints documented inreference/endpoints.md.\n - Boundary markers: No specific delimiters or warnings for the agent to ignore instructions within the data are provided.\n
- Capability inventory: The skill is limited to making authenticated GET requests to the vendor API.\n
- Sanitization: The helper script ensures all query parameters are URL-encoded.
Audit Metadata