mlb-playoff-scheduler
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSTIME_DELAYED_CONDITIONALINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches schedule and statistical data from well-known and reputable sports information services, including MLB.com and FanGraphs. These operations are necessary for the skill's functional purpose and utilize trusted sources for professional baseball data.\n- [TIME_DELAYED_CONDITIONAL]: The skill implements a date-based gate (July 1, 2026) that restricts calculations until the MLB trade deadline approach. This logic is a functional requirement to ensure data accuracy by waiting for roster and schedule stabilization, and is not a malicious evasion technique.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external websites, creating a theoretical surface for indirect prompt injection.\n
- Ingestion points: Web search results from MLB.com, FanGraphs, ESPN, and CBS Sports are used to gather game counts and player statistics.\n
- Boundary markers: The instructions do not define specific delimiters or instructions for the agent to ignore potential commands embedded in the retrieved web data.\n
- Capability inventory: The skill's capabilities are limited to writing signal files in markdown and invoking a validation tool. It does not have access to shell execution or sensitive system files.\n
- Sanitization: The skill's methodology involves extracting and normalizing specific numerical metrics (wOBA, games played), which naturally limits the impact of any non-statistical text content found on the target pages.
Audit Metadata