The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The setup instructions in SKILL.md direct the installation of the sports-skills package via pip install from PyPI or directly from the author's GitHub repository (https://github.com/machina-sports/sports-skills.git). These resources are owned by the skill author and are necessary for the skill's functionality.
[COMMAND_EXECUTION]: The skill utilizes a custom CLI tool (sports-skills) for data retrieval and includes a shell script (scripts/validate_params.sh) used for validating input parameters like season_id and checking league coverage.
[INDIRECT_PROMPT_INJECTION]: The skill aggregates data from several external sources including ESPN, Understat, FPL, and Transfermarkt. This data is processed by the agent to generate responses, which introduces a potential attack surface.
Ingestion points: External data endpoints for standings, schedules, xG, and player statistics (ESPN, Understat, football-data.co.uk).
Boundary markers: There are no explicit instructions or delimiters provided to ensure the agent ignores potentially malicious instructions embedded within the match statistics or player profiles.
Capability inventory: The skill possesses the ability to execute shell commands via the CLI and install Python packages during the setup phase.
Sanitization: The instructions do not define any sanitization or filtering protocols for the data retrieved from external APIs before it is presented to the agent.

football-data