pp-espn
Pass
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and installs the
espn-pp-cliandespn-pp-mcpbinaries from the author's GitHub repository (github.com/mvanhorn/printing-press-library) usinggo installandnpx(via@mvanhorn/printing-press).- [COMMAND_EXECUTION]: Executes theespn-pp-clibinary to perform sports data lookups, local database synchronization, and system connectivity checks.- [DATA_EXFILTRATION]: Contains features designed to transmit data to external locations. The--deliverflag allows command results to be sent to arbitrary webhooks or local files. Thefeedbackcommand also supports POSTing data to a remote server defined by theESPN_FEEDBACK_ENDPOINTenvironment variable.- [PROMPT_INJECTION]: The skill processes untrusted sports data from ESPN's public endpoints, presenting a risk of indirect prompt injection. If the source data is manipulated to include malicious instructions, the agent may follow them. - Ingestion points: External API responses from ESPN fetched via
espn-pp-cli. - Boundary markers: None present; the skill lacks delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill can perform file-write and network-send operations through the
--deliverandfeedbackfunctionalities. - Sanitization: No explicit content validation or escaping of the sports data is provided beyond the use of field filtering via
--select.
Audit Metadata