nutmeg-acquire

Pass

Audited by Gen Agent Trust Hub on May 12, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill implements secure credential management by instructing the agent to store API keys in gitignored files such as .env and *.local. It explicitly forbids committing keys to version control or logging them to output.
  • [SAFE]: External data acquisition is limited to well-known football data providers (e.g., StatsBomb, SportMonks, FBref) and the author's own verified repositories. The skill includes a dedicated security section that warns the agent to treat all external content as untrusted and to validate data schemas before processing, which mitigates indirect prompt injection risks.
  • [SAFE]: The skill utilizes established, domain-specific Python libraries and R packages for sports data analysis and includes guidance on rate limiting and local caching to ensure respectful use of external APIs.
Audit Metadata
Risk Level
SAFE
Analyzed
May 12, 2026, 08:28 PM