The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API endpoints managed by the vendor (e.g., weather forecasts, destination facts, and visa requirements). This represents a potential surface for indirect prompt injection if the remote data source were compromised, though no specific vulnerabilities were identified.
Ingestion points: Data retrieved from sorted.travel via tools like get_destination_info and get_destination_weather (SKILL.md).
Boundary markers: None explicitly defined in the instruction text.
Capability inventory: The skill has the ability to read and write to user profiles via OAuth-protected endpoints and performs network operations to vendor infrastructure (SKILL.md).
Sanitization: No explicit sanitization or validation of the API-returned content is mentioned before it is presented to the agent.
[EXTERNAL_DOWNLOADS]: The skill connects to a Model Context Protocol (MCP) server at https://sorted.travel/mcp and references various configuration files (OpenAPI specs, server cards) located on the same domain. These resources are provided by the skill author for legitimate functionality.

sorted-travel