cfb-data
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
sports-skillsPython package viapipto enable its core data-fetching functionality. The package is a specialized utility provided for this skill's use case. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection through its data ingestion process.
- Ingestion points: External sports data is fetched from ESPN and NCAA public API endpoints via the
sports-skillsCLI tool and presented to the agent. - Boundary markers: The instructions do not specify boundary markers or include warnings to ignore instructions that might be embedded in the fetched sports data.
- Capability inventory: The skill utilizes CLI execution (
sports-skills cfbandmachina sports cfb) to retrieve data. - Sanitization: There is no documentation of sanitization or filtering performed on the data retrieved from external sources before it is interpolated into the agent's context.
Audit Metadata