The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Fetches athlete profiles, meet results, and team rosters from tfrrs.org and news content from thestridereport.com as part of its core functionality.
[EXTERNAL_DOWNLOADS]: Downloads and installs the sports-skills Python package from the vendor's repository at github.com/machina-sports/sports-skills.git during the setup phase.
[COMMAND_EXECUTION]: Executes the sports-skills CLI tool to perform data retrieval and search operations.
[COMMAND_EXECUTION]: Includes a bash script scripts/validate_params.sh designed to ensure required arguments are provided to the sports data commands.
[REMOTE_CODE_EXECUTION]: Instructs the agent to perform a pip install from a remote Git URL, which involves the execution of the package's installation scripts.
[PROMPT_INJECTION]: Indirect prompt injection surface identified:
Ingestion points: External sports data and news summaries are ingested via the get_athlete_profile and get_news tools.
Boundary markers: No explicit markers or warnings are used to prevent the agent from interpreting instructions that might be embedded in the athlete names, meet descriptions, or news titles.
Capability inventory: The skill has the capability to execute arbitrary CLI commands provided by the sports-skills package.
Sanitization: No specific sanitization or validation of the retrieved external content is described in the provided files.

xctf-data