sports-betting-research
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a local bash script
scripts/crawlora.shto interact with an external API. This script is defensively designed with strict whitelisting of allowed API paths and validation of the API key format to prevent injection attacks.\n- [EXTERNAL_DOWNLOADS]: The skill makes network requests toapi.crawlora.netto fetch sports market data and commentary. This domain is the official service endpoint associated with the skill's authoring organization.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sportsbooks and news sources via the Crawlora API. This creates a surface for third-party content to enter the agent's context.\n - Ingestion points: Data is retrieved from
api.crawlora.netusing thescripts/crawlora.shutility.\n - Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the provided skill instructions.\n
- Capability inventory: The skill can execute the
scripts/crawlora.shscript, which has network access viacurl.\n - Sanitization: The helper script URL-encodes outgoing parameters using
curl's built-in flags, though it does not explicitly sanitize the incoming JSON payload from the API.
Audit Metadata