The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends installing official SDKs (scavio for Python and Node.js) and the @scavio/mcp-server package. These are vendor-owned resources used to interact with the API endpoints.
[INDIRECT_PROMPT_INJECTION]: The skill retrieves product data (names, descriptions, ingredients) from the ALDI API. This represents a standard attack surface where external content could potentially contain instructions aimed at the agent.
Ingestion points: Data enters the agent's context from api.scavio.dev via the /search and /product endpoints, specifically in text fields like description and ingredients as defined in SKILL.md.
Boundary markers: There are no specific delimiters or instructions for the agent to treat the API-returned content as untrusted data.
Capability inventory: The skill is designed for data retrieval and does not have higher-privilege capabilities (such as file-system writes or shell execution) that could be exploited.
Sanitization: No specific sanitization or filtering of the API-returned content is documented in the skill instructions.

aldi-grocery-data