sports-reporter

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill generates and runs shell commands using the sports-skills CLI. These commands are constructed dynamically based on user-provided parameters such as team names, player names, and event dates.
  • [EXTERNAL_DOWNLOADS]: During setup, the skill prompts for the installation of the sports-skills package from PyPI or the author's official GitHub repository (github.com/machina-sports/sports-skills.git). As these are vendor-owned resources, they are treated as standard operational dependencies.
  • [INDIRECT_PROMPT_INJECTION]: The skill fetches external sports data, news headlines, and play-by-play descriptions which are then interpolated into article templates.
  • Ingestion points: Data retrieved from external CLI modules described in SKILL.md and references/api-reference.md, including news and live match updates.
  • Boundary markers: The skill uses narrative templates defined in references/article-templates.md to structure its output, providing a fixed format for the ingested data.
  • Capability inventory: The skill can execute CLI commands and install Python packages via pip.
  • Sanitization: There is no explicit sanitization or validation logic described for the external data before it is processed by the agent, relying on the agent's default processing capabilities.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 02:55 PM