shipp-sports-data
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
@moonpay/clipackage via npm. This is a vendor-managed tool required for wallet operations and is a legitimate functional dependency within the skill author's ecosystem.\n- [COMMAND_EXECUTION]: The skill utilizescurlfor API requests and thempCLI for executing prediction market trades. These actions are documented as core components of the agent's workflow for sports data processing and trading.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests external sports data from a third-party API to drive automated trading decisions.\n - Ingestion points: Live sports updates and event data retrieved from
api.shipp.aias described inSKILL.md.\n - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are defined in
SKILL.md.\n - Capability inventory: The skill employs the
mpCLI to perform sensitive financial operations, including buying positions in prediction markets and managing wallet assets as shown inSKILL.md.\n - Sanitization: The skill instructions do not specify any validation or sanitization processes for the data received from the external Shipp API before it influences agent actions.
Audit Metadata