the-sports-db
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data fetched from an external API (TheSportsDB), creating a potential surface for indirect prompt injection if the API returns malicious instructions.
- Ingestion points: Data is ingested via
curlcommands tothesportsdb.cominSKILL.md. - Boundary markers: None detected; the examples do not show delimiters or instructions to ignore embedded content within the API responses.
- Capability inventory: The skill uses
curlfor network retrieval of JSON data. - Sanitization: No explicit sanitization or validation of the API response content is defined in the instruction set.
Audit Metadata