multi-sport-match-research
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts as an ingestion surface for external sports data, which is processed by the agent to fulfill user requests.
- Ingestion Points: Sports fixtures, statistics, and news summaries fetched via
scripts/crawlora.shfrom the vendor API atapi.crawlora.net. - Boundary Markers: Instructions in
SKILL.mddirect the agent to preserve source identifiers and distinguish between provider snapshots, but no explicit structural delimiters are defined for the fetched data. - Capability Inventory: The skill's capabilities are limited to performing network GET requests to the specific vendor API.
- Sanitization: The included helper script implements best practices, such as URL-encoding all query parameters, using a secure temporary configuration file for the API key to prevent exposure in process lists, and enforcing a strict allow-list of authorized API paths.
Audit Metadata