The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill documentation instructs the user to install the sports-skills package from PyPI or GitHub. The repository https://github.com/machina-sports/sports-skills.git is not associated with a trusted organization or well-known service.\n- [REMOTE_CODE_EXECUTION]: Installing a package directly from a git repository using pip install git+ allows for the execution of arbitrary code during the installation process via setup.py or other installation hooks.\n- [COMMAND_EXECUTION]: The skill relies on the sports-skills CLI for its primary functionality and executes a local shell script scripts/validate_params.sh for parameter validation. These operations involve system-level command execution.\n- [PROMPT_INJECTION]: The skill ingests user-provided strings such as team names and event IDs (e.g., in the search_team query) and incorporates them into command-line executions. Lack of comprehensive sanitization (only season_id is validated in scripts/validate_params.sh) creates an attack surface for indirect prompt injection or command injection. The ingestion points include the query and event_id parameters in SKILL.md, while the capability inventory includes CLI calls to the sports-skills tool.

football-data