The Agent Skills Directory

[PROMPT_INJECTION]: No prompt injection or behavior override patterns were detected. The included prompts are purely instructional and guide the AI agent on how to use the available sports data tools.
[DATA_EXFILTRATION]: The skill includes a robust security check in src/client.ts that restricts all outgoing HTTP requests to a predefined list of trusted ESPN domains. This effectively prevents the server from being used to exfiltrate data to unauthorized third-party hosts.
[REMOTE_CODE_EXECUTION]: No remote code execution patterns or unsafe dynamic execution functions (like eval or exec) were found in the codebase. The server uses standard MCP and Express patterns for handling requests.
[INDIRECT_PROMPT_INJECTION]: While the skill ingests external data from ESPN APIs (creating a theoretical surface for indirect injection), it treats all incoming data as structured JSON and does not execute content. The risk is considered minimal and standard for data-retrieval skills.
[OBFUSCATION]: No obfuscated code, encoded commands, or hidden instructions were found in any of the analyzed files.

espn-api