duv
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous examples and instructions for using the
curltool to fetch data from the DUV website. This is the primary mechanism for interaction given the lack of an official API. - [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download HTML content from
https://statistik.d-u-v.org/to parse race rankings, event metadata, and athlete profiles. - [INDIRECT_PROMPT_INJECTION]: The skill involves processing data from an external, untrusted source (third-party website HTML).
- Ingestion points: HTML responses from DUV endpoints like
searchrunner.phpandgetintbestlist.phpare processed by the agent. - Boundary markers: No explicit delimiters or instructions to ignore embedded content are provided.
- Capability inventory: The skill utilizes
curlfor data retrieval; no dangerous write operations or further command executions on the fetched data are identified. - Sanitization: The instructions focus on parsing logic for parameters but do not specify sanitization for the ingested HTML content. Given the nature of the data source (sports statistics), the risk of adversarial content is low.
Audit Metadata