nflreadpy

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (nflverse) using the nflreadpy library. This creates a potential surface for indirect prompt injection if the source data were to be maliciously modified to include instructions for the AI agent.
  • Ingestion points: scripts/load_game_panel.py and scripts/smoke_load.py call nfl.load_schedules() to fetch data from remote nflverse repositories.
  • Boundary markers: None identified; the skill processes raw data into Parquet/JSON formats without explicit instruction delimiters.
  • Capability inventory: scripts/load_game_panel.py writes data to the file system using polars.write_parquet(). SKILL.md includes instructions for package installation via pip.
  • Sanitization: The scripts perform data validation, including type casting (e.g., pl.Float64 for scores), null checks, and duplicate detection, which helps ensure data integrity.
  • [EXTERNAL_DOWNLOADS]: The skill is designed to download NFL datasets from external repositories managed by the nflverse community. The core library nflreadpy handles these network requests to retrieve structured data. Additionally, the skill documentation suggests installing nflreadpy, polars, and pyarrow via pip, which are standard packages for sports analytics and data processing.
  • [COMMAND_EXECUTION]: The skill provides utility scripts that perform local file system operations, such as reading and writing Parquet, CSV, and JSON files. These scripts are used to create, describe, and validate data panels for research purposes.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 06:31 PM
Security Audit — agent-trust-hub — nflreadpy