The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's setup instructions direct the agent to install the sports-skills Python package using pip. This represents an external dependency on a package that is not from a recognized trusted vendor or a well-known service.
[INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes data from external sources, including the ESPN and NHL public APIs. This content (e.g., news articles and player statistics) is ingested into the agent's context and could contain malicious instructions designed to manipulate agent behavior.
Ingestion points: Data is fetched via commands like get_news, get_scoreboard, and get_game_summary from external endpoints like api-web.nhle.com.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to separate untrusted external data from the skill's instructions.
Capability inventory: The skill has the capability to fetch diverse data from remote APIs and requires shell command execution for initial setup.
Sanitization: No sanitization or validation of the data retrieved from external sources is described in the skill's instructions or scripts.

nhl-data