The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes product names, descriptions, and promotional text retrieved from PetSmart through the Scavio API. This external data is interpolated into the agent's context, creating a potential surface for indirect prompt injection if the source data were to contain malicious instructions.
Ingestion points: Data enters the agent context via responses from the https://api.scavio.dev endpoints described in SKILL.md (e.g., /search, /product, /deals).
Boundary markers: The skill does not provide instructions for the agent to use delimiters or specific warnings to ignore instructions that might be embedded within the product data.
Capability inventory: The skill enables network operations (HTTPS POST requests) to the Scavio API.
Sanitization: The skill lacks explicit instructions for sanitizing or escaping the retrieved product content before it is processed or presented.
[EXTERNAL_DOWNLOADS]: The skill references several external dependencies and a package runner to facilitate its core functionality.
Evidence: The SKILL.md file recommends the installation of the scavio==0.33.0 Python package, the scavio@0.33.0 Node.js package, and the execution of the @scavio/mcp-server@0.31.0 tool via npx. These resources are provided by the skill author (scavio-ai) and use specific version pinning.

petsmart-product-data