The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources including ESPN public endpoints, the NBA live CDN, and NBA Stats. This data is processed by the agent to answer user queries, creating a surface for indirect prompt injection if the source content is maliciously crafted.
Ingestion points: Data is fetched via commands such as get_scoreboard, get_news, and various get_nbastats_* endpoints, which are then integrated into the agent's context.
Boundary markers: The instructions do not provide specific delimiters or 'ignore' instructions to help the agent distinguish between its instructions and the data fetched from external APIs.
Capability inventory: The skill facilitates the execution of shell commands through the sports-skills CLI tool.
Sanitization: There are no explicit instructions or mechanisms mentioned for sanitizing, validating, or filtering the content returned from the external APIs before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill setup process involves installing the sports-skills package using pip. While this package appears to be the primary tool provided by the author, installing code from public registries carries inherent supply-chain risks.

nba-data