cricket-data

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches cricket data from ESPN's public endpoints and match data (ZIP/CSV) from Cricsheet. These are well-known and reputable services for sports statistics and news.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for ingesting external data that could theoretically be manipulated by an attacker at the source.
  • Ingestion points: Match news, summaries, and scoreboard data retrieved from ESPN and Cricsheet via the CLI.
  • Boundary markers: No explicit delimiters or instructions are used to separate external data from agent instructions.
  • Capability inventory: Shell execution of the local sports-skills CLI and parameter validation script, plus file system write access for local data caching.
  • Sanitization: No visible sanitization logic for external strings in the provided instruction files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 03:42 PM