nutmeg-acquire
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements secure credential management by instructing the agent to store API keys in gitignored files such as
.envand*.local. It explicitly forbids committing keys to version control or logging them to output. - [SAFE]: External data acquisition is limited to well-known football data providers (e.g., StatsBomb, SportMonks, FBref) and the author's own verified repositories. The skill includes a dedicated security section that warns the agent to treat all external content as untrusted and to validate data schemas before processing, which mitigates indirect prompt injection risks.
- [SAFE]: The skill utilizes established, domain-specific Python libraries and R packages for sports data analysis and includes guidance on rate limiting and local caching to ensure respectful use of external APIs.
Audit Metadata