cricket-data
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches cricket data from ESPN's public endpoints and match data (ZIP/CSV) from Cricsheet. These are well-known and reputable services for sports statistics and news.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for ingesting external data that could theoretically be manipulated by an attacker at the source.
- Ingestion points: Match news, summaries, and scoreboard data retrieved from ESPN and Cricsheet via the CLI.
- Boundary markers: No explicit delimiters or instructions are used to separate external data from agent instructions.
- Capability inventory: Shell execution of the local
sports-skillsCLI and parameter validation script, plus file system write access for local data caching. - Sanitization: No visible sanitization logic for external strings in the provided instruction files.
Audit Metadata