The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references the official 'scavio' library available on NPM and PyPI. These are vendor-provided SDKs for the Scavio API and are legitimate resources for the skill's functionality.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted third-party data from Nordstrom Rack, including customer reviews, AI-generated review summaries, and product descriptions.
Ingestion points: API responses from https://api.scavio.dev mapped to fields like reviews[].text, ai_summary, and description in SKILL.md.
Boundary markers: The documentation suggests checking for null values in review text, but does not explicitly define prompt delimiters for the data.
Capability inventory: The skill uses network operations to fetch data but does not contain file-system write or subprocess execution capabilities.
Sanitization: No specific sanitization or filtering of review content is described before the data is presented to the agent.
[COMMAND_EXECUTION]: Provides standard curl commands and Python scripts as implementation examples. These use the Authorization: Bearer pattern for secure API key handling and do not include dangerous or obfuscated command sequences.

nordstrom-rack-product-data