The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user or agent to download and run the livetennisapi-mcp package directly from the NPM registry using npx -y. It also references related libraries such as livetennisapi and livetennisapi-ai available via NPM and PyPI.
[COMMAND_EXECUTION]: Provides multiple shell commands for setting up environment variables (export LIVETENNISAPI_KEY), adding MCP servers to Claude/Codex, and cloning the source repository from GitHub for local development.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a bridge for external, real-time data (match scores, player profiles, betting odds, and ML win probabilities) into the agent's context. This data ingestion represents a potential attack surface where malicious content embedded in the API responses could attempt to influence the agent's reasoning or actions.
Ingestion points: Multiple tool outputs including get_live_matches, get_match, search_players, get_recent_results, get_match_odds, and get_match_analysis (SKILL.md).
Boundary markers: No explicit delimiters or boundary markers for external data are defined within the skill instructions.
Capability inventory: The agent typically operates in environments (like Claude Desktop or Cursor) with capabilities for file system access, shell command execution, and network communication.
Sanitization: The skill does not define sanitization or validation logic for the structured JSON data returned by the API before it is processed by the agent.
[CREDENTIALS_UNSAFE]: The documentation includes a configuration example for a web connector that passes the API token as a query parameter (https://mcp.livetennisapi.com/mcp?token=...). Although the author includes a security note recommending the use of headers instead, providing the query parameter pattern introduces a risk of credential leakage via server logs or browser history.

livetennisapi-mcp-integration