Harden footballbin-predictions skill security

[billychl1]

Summary

• remove URL-in-table endpoint pattern that triggered security scanners
• keep app links in SKILL.md as requested
• harden script networking and input validation
• remove app-download lines from CLI output

Validation

• bash -n on scripts/footballbin.sh passes
• no curl|bash or URL-pipe patterns remain

---

Summary by cubic

Strengthened the footballbin-predictions skill security and fixed CI permissions so security audit comments work for Dependabot. Fewer scanner flags and more reliable CI.

• Area: components (cli-tool/components/skills/sports/footballbin-predictions)
• Script: split host/path/scheme; curl uses fail/show-error/silent/max-time; validate league/team; removed app download lines; no installs
• Docs: Quick Start → Usage; endpoint shown as Host/Path/Method; app links kept as plain lines
• CI: security-audit skips PR comments on forks; added pull-requests: write permission to prevent Dependabot 403
• No new components; no catalog regen; no new env vars or secrets

^{Written for commit dcf7ed1. Summary will update on new commits.}

[vercel]

@billychl1 is attempting to deploy a commit to the Daniel Avila's projects Team on Vercel.

A member of the Team first needs to authorize it.

[cubic-dev-ai]

No issues found across 2 files

[cubic-dev-ai]

1 issue found across 1 file (changes from recent commits).

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/component-security-validation.yml">

<violation number="1" location=".github/workflows/component-security-validation.yml:60">
P2: Dependabot PRs still run this comment step with a read-only GITHUB_TOKEN, so github.rest.issues.createComment will fail with 403 despite the same-repo check.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[billychl1]

@cubic-dev-ai to re-run a review.

[cubic-dev-ai]

@cubic-dev-ai to re-run a review.

@billychl1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 3 files

[billychl1]

@davila7 Could you authorize the Vercel deployments for this PR? The Security Audit and code review checks are passing. Thanks!