nflreadpy
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (nflverse) using the nflreadpy library. This creates a potential surface for indirect prompt injection if the source data were to be maliciously modified to include instructions for the AI agent.
- Ingestion points:
scripts/load_game_panel.pyandscripts/smoke_load.pycallnfl.load_schedules()to fetch data from remote nflverse repositories. - Boundary markers: None identified; the skill processes raw data into Parquet/JSON formats without explicit instruction delimiters.
- Capability inventory:
scripts/load_game_panel.pywrites data to the file system usingpolars.write_parquet().SKILL.mdincludes instructions for package installation viapip. - Sanitization: The scripts perform data validation, including type casting (e.g.,
pl.Float64for scores), null checks, and duplicate detection, which helps ensure data integrity. - [EXTERNAL_DOWNLOADS]: The skill is designed to download NFL datasets from external repositories managed by the nflverse community. The core library
nflreadpyhandles these network requests to retrieve structured data. Additionally, the skill documentation suggests installingnflreadpy,polars, andpyarrowvia pip, which are standard packages for sports analytics and data processing. - [COMMAND_EXECUTION]: The skill provides utility scripts that perform local file system operations, such as reading and writing Parquet, CSV, and JSON files. These scripts are used to create, describe, and validate data panels for research purposes.
Audit Metadata