sportsdataverse-py
Warn
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/smoke_load.pyand the instructions inSKILL.mduseimportlib.import_module()to dynamically load league submodules based on computed strings. While the script validates module names against known submodules, this pattern of dynamic loading from computed paths is identified as a sensitive code execution method. - [INDIRECT_PROMPT_INJECTION]: The skill processes data fetched from external sports APIs, which presents a surface for indirect prompt injection. \n
- Ingestion points: External data is ingested through various loader functions provided by the
sportsdataversepackage. \n - Boundary markers: No explicit markers are used to delimit external data from instructions. \n
- Capability inventory: The skill environment supports file system access and Python code execution. \n
- Sanitization: No sanitization of the external sports data is performed before the agent processes it.
Audit Metadata