wnba-data
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions include a setup step to install the
sports-skillspackage usingpipif the command is not present in the environment. This is a standard procedure for tools distributed via the Python Package Index. - [COMMAND_EXECUTION]: The skill operates by executing shell commands using the
sports-skillsCLI. The instructions include steps to check for the command's availability and verify parameters before execution. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided strings, such as team names and dates, which are interpolated into CLI command arguments. The skill includes a bash script (
scripts/validate_params.sh) that performs basic validation on the date format and team ID parameters to mitigate potential injection or formatting errors. - Ingestion points: User queries for WNBA scores, rosters, or stats in
SKILL.md. - Boundary markers: None explicitly defined in the example command templates.
- Capability inventory: Executes local CLI commands via subprocess calls as defined in the
Commandstable. - Sanitization: Employs
scripts/validate_params.shto validate that dates follow theYYYY-MM-DDregex and thatteam_idis provided.
Audit Metadata