sports-reporter
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill generates and runs shell commands using the
sports-skillsCLI. These commands are constructed dynamically based on user-provided parameters such as team names, player names, and event dates. - [EXTERNAL_DOWNLOADS]: During setup, the skill prompts for the installation of the
sports-skillspackage from PyPI or the author's official GitHub repository (github.com/machina-sports/sports-skills.git). As these are vendor-owned resources, they are treated as standard operational dependencies. - [INDIRECT_PROMPT_INJECTION]: The skill fetches external sports data, news headlines, and play-by-play descriptions which are then interpolated into article templates.
- Ingestion points: Data retrieved from external CLI modules described in
SKILL.mdandreferences/api-reference.md, including news and live match updates. - Boundary markers: The skill uses narrative templates defined in
references/article-templates.mdto structure its output, providing a fixed format for the ingested data. - Capability inventory: The skill can execute CLI commands and install Python packages via
pip. - Sanitization: There is no explicit sanitization or validation logic described for the external data before it is processed by the agent, relying on the agent's default processing capabilities.
Audit Metadata