The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references the scavio package available on PyPI and the NPM registry. These packages are official integration libraries provided by the vendor (scavio-ai) to facilitate API requests.
[REMOTE_CODE_EXECUTION]: The documentation includes instructions to use npx to execute @scavio/mcp-server@0.16.1. This pattern involves downloading and running the vendor's Model Context Protocol server, which is a standard method for providing tool access to agents.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process product data, including names and descriptions, from various external Decathlon domains. This creates an attack surface where malicious instructions embedded in product listings on these third-party websites could influence the agent's behavior if not properly handled.
Ingestion points: Metadata and text content retrieved from the POST /api/v1/decathlon/search and POST /api/v1/decathlon/product endpoints (referenced in SKILL.md).
Boundary markers: Absent. The skill does not instruct the agent to use delimiters or specific parsing rules to isolate the untrusted external product data from the system prompt.
Capability inventory: The skill enables network operations to the api.scavio.dev domain.
Sanitization: The documentation mentions that the API normalizes data structures, but it does not specify any content-level sanitization or filtering to prevent the execution of instructions contained within the product descriptions.

decathlon-product-data