cbb-data
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the sports-skills Python package, which is a vendor-owned resource authored by machina-sports and necessary for the skill's data-fetching capabilities.
- [COMMAND_EXECUTION]: The skill uses shell commands to check for the presence of the required CLI tool and performs installation via pip when necessary.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests sports-related news, scores, and play-by-play data from ESPN and NCAA APIs, which represents a potential data ingestion surface. However, given the specific and structured nature of the data, the risk is negligible. Ingestion points: Data retrieved via commands like get_news and get_scoreboard (references/api-reference.md); Boundary markers: Absent; Capability inventory: Shell command execution for package installation (SKILL.md); Sanitization: None identified.
Audit Metadata