The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill directs the user to install and execute the marketplaces-mcp-ru package (and marketplace-specific variants like ozon-mcp-ru, wildberries-mcp-ru, yandex-market-mcp-ru, and avito-mcp-ru) using uvx. This entails downloading and executing code from an external, third-party package registry.
[COMMAND_EXECUTION]: The provided configuration for Claude Desktop and other clients involves setting up a command-line execution (uvx marketplaces-mcp-ru), which allows the agent to run external binaries on the host system.
[DATA_EXFILTRATION]: The skill manages highly sensitive marketplace API tokens (for Wildberries, Ozon, Yandex Market, and Avito). These credentials are either stored in environment variables or in a local file located at ~/.marketplace-mcp/cabinets.json. Accessing or creating files that store raw API credentials poses a significant data exposure risk if the environment is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill functions as a bridge to external marketplace Seller APIs, ingesting data such as order details and product descriptions that could contain untrusted, attacker-controlled content.
Ingestion points: Data retrieved from official Seller APIs of Wildberries, Ozon, Yandex Market, and Avito.
Boundary markers: None; there are no specific instructions or delimiters to help the agent distinguish between API data and its own system instructions.
Capability inventory: The skill provides tools for reading and writing data (e.g., ym_call_method, wb_search_methods) across multiple platforms.
Sanitization: The instructions do not specify any sanitization or validation processes for the data returned from the external APIs.

marketplaces-mcp