cfb-data

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the sports-skills Python package via pip to enable its core data-fetching functionality. The package is a specialized utility provided for this skill's use case.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection through its data ingestion process.
  • Ingestion points: External sports data is fetched from ESPN and NCAA public API endpoints via the sports-skills CLI tool and presented to the agent.
  • Boundary markers: The instructions do not specify boundary markers or include warnings to ignore instructions that might be embedded in the fetched sports data.
  • Capability inventory: The skill utilizes CLI execution (sports-skills cfb and machina sports cfb) to retrieve data.
  • Sanitization: There is no documentation of sanitization or filtering performed on the data retrieved from external sources before it is interpolated into the agent's context.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 01:21 PM