wnba-data

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions include a setup step to install the sports-skills package using pip if the command is not present in the environment. This is a standard procedure for tools distributed via the Python Package Index.
  • [COMMAND_EXECUTION]: The skill operates by executing shell commands using the sports-skills CLI. The instructions include steps to check for the command's availability and verify parameters before execution.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided strings, such as team names and dates, which are interpolated into CLI command arguments. The skill includes a bash script (scripts/validate_params.sh) that performs basic validation on the date format and team ID parameters to mitigate potential injection or formatting errors.
  • Ingestion points: User queries for WNBA scores, rosters, or stats in SKILL.md.
  • Boundary markers: None explicitly defined in the example command templates.
  • Capability inventory: Executes local CLI commands via subprocess calls as defined in the Commands table.
  • Sanitization: Employs scripts/validate_params.sh to validate that dates follow the YYYY-MM-DD regex and that team_id is provided.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 02:55 PM