The Agent Skills Directory

[SAFE]: The skill does not contain any detected malicious patterns or security vulnerabilities. It consistently emphasizes security best practices, such as server-side secret storage and avoiding the transmission of sensitive data in logs or chat.
[CREDENTIALS_SAFE]: The instructions explicitly forbid hardcoding secrets. It provides clear guidance on using environment variables (e.g., LISTINGSAPI_KEY) and secret stores, and warns against committing keys to version control or returning them to browsers.
[EXTERNAL_DOWNLOADS]: The skill references official vendor packages (listingsapi for Python and listingsapi-js for Node.js) and standard libraries like requests. These are well-known, legitimate resources related to the skill's primary purpose.
[COMMAND_EXECUTION]: Code examples provided are for implementation guidance and do not perform unauthorized or dangerous system commands. Subprocess execution is absent, and network operations are limited to the vendor's official API domain (listingsapi.com).
[INDIRECT_PROMPT_INJECTION]: While the skill involves processing external data (reviews and location information) and has write capabilities, it implements strong mitigation by mandating explicit user review and approval before any consequential action is taken. It also uses structured data handling to minimize injection risks.

listingsapi-integration