sports-ds-bridge
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to clone the sports-analytic-skills repository from the vendor's GitHub and install the sports_ds toolkit using pip. These operations are standard installation procedures for the vendor's provided tools.
- [COMMAND_EXECUTION]: Shell commands are utilized for environment configuration, dependency management, and running analytical pipelines. These commands are localized to the skill's primary function and include best practices such as using virtual environments.
- [INDIRECT_PROMPT_INJECTION]: The skill manages the ingestion of external data from various sports providers. It includes a structured validation workflow to maintain data integrity before handoff:
- Ingestion points: Data is loaded via the sports_ds.data loaders defined in SKILL.md and references/toolkit-map.md.
- Boundary markers: The skill requires the creation of portable artifacts (CSV/Parquet) and explicit validation against downstream contracts to prevent instruction leakage.
- Capability inventory: The skill uses file system writes for data persistence and shell commands for toolkit interaction.
- Sanitization: Mandatory checks for required columns, observation grain, and time-field consistency are outlined in SKILL.md and references/handoff-contracts.md.
Audit Metadata