The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted third-party data from Booking.com, including property descriptions and guest reviews, which are processed by the agent.
Ingestion points: API responses from the /api/v1/booking/hotel and /api/v1/booking/reviews endpoints mentioned in SKILL.md.
Boundary markers: The skill provides a 'Guardrails' section instructing the agent not to fabricate data, but it does not specify the use of delimiters or explicit warnings to ignore instructions embedded within the review text.
Capability inventory: The skill performs network operations via POST requests to api.scavio.dev and uses local file-system writes if the agent saves the structured JSON output.
Sanitization: There is no evidence of sanitization or filtering of the guest-provided text before it is presented to the agent's context.
[EXTERNAL_DOWNLOADS]: The skill documentation recommends the installation of the scavio package via pip and npm. These are vendor-specific libraries provided by the skill author for API interaction.
[COMMAND_EXECUTION]: The skill performs network operations using requests.post in Python and fetch/scavio SDK calls in JavaScript to api.scavio.dev. These requests are necessary for the skill's primary function of retrieving travel data.

booking-com-hotel-data