The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references specific versions of the vendor's own software development kits (scavio for Node.js and Python) and a Model Context Protocol (MCP) server (@scavio/mcp-server). These are standard library dependencies for the skill's functionality.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources (Kroger banner websites via the Scavio API), which could theoretically contain malicious instructions.
Ingestion points: Data including product descriptions, nutrition facts, ingredients, allergens, and coupon details are ingested from api.scavio.dev (SKILL.md).
Boundary markers: The instructions guide the agent to extract specific structured fields and return only what the API provided, although explicit delimiters for external content are not specified.
Capability inventory: The skill's capabilities are limited to network requests for data retrieval and display; no high-privilege capabilities such as file system writes or arbitrary command execution are present.
Sanitization: There are no explicit instructions for sanitizing or escaping the retrieved external content before it is presented to the user or processed by the agent.

kroger-grocery-data