The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and display untrusted data retrieved from third-party retailers, which presents a surface for indirect prompt injection.
Ingestion points: The agent is instructed to capture and display product titles, seller names, and shipping information from various retailer APIs (Amazon, Walmart, eBay, etc.) as described in Step 2 of the Procedure in SKILL.md.
Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat the captured retailer data as untrusted or to ignore any instructions embedded within those strings.
Capability inventory: The skill uses network operations to query the Scavio API and displays the results to the user.
Sanitization: The skill lacks explicit sanitization or escaping instructions for the external content before it is interpolated into the final output table.
[SAFE]: All external resource references are consistent with the infrastructure of the skill's author.
Evidence: URLs such as scavio.dev, mcp.scavio.dev, dashboard.scavio-ai.dev, and the github.com/scavio-ai repository are official vendor domains and repositories belonging to the author 'scavio-ai'.

price-drop-watch