The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references specific versions of the scavio package on PyPI (0.42.0) and NPM (0.43.0), as well as the @scavio/mcp-server package via npx. These are established packages provided by the skill author and hosted on standard registries.
[CREDENTIALS_UNSAFE]: No hardcoded secrets were detected. The documentation correctly instructs users to provide the SCAVIO_API_KEY via environment variables and includes a safety reminder to keep keys out of source control.
[DATA_EXFILTRATION]: Network activity is limited to the vendor's API endpoint (api.scavio.dev) and Macy's official asset domains for legitimate data retrieval. There is no evidence of unauthorized data transfer or sensitive file access.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface as it ingests external data (product descriptions and reviews) from the Macy's API. However, the data is used for structured output and analysis without being passed into high-risk capabilities like shell execution or code interpretation, minimizing the risk of injection-based exploitation.

macys-product-data