The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes external data (product titles, descriptions, coupon terms, and nutrition facts) from the Publix API. This data is incorporated into the agent's context, creating a surface for indirect prompt injection if the source content were to contain malicious instructions.
Ingestion points: JSON responses from all 11 endpoints hosted on api.scavio.dev as described in SKILL.md.
Boundary markers: The instructions do not define clear boundary markers or provide specific guidance to the agent to ignore potentially malicious instructions embedded within the retrieved data.
Capability inventory: The skill performs network operations to the vendor's API.
Sanitization: No explicit sanitization or validation of the retrieved strings is mentioned before they are presented to the agent.
[EXTERNAL_DOWNLOADS]: The skill documentation recommends the installation of vendor-owned packages scavio (via pip and npm) and @scavio/mcp-server (via npx). These are legitimate resources belonging to the author, scavio-ai.
[COMMAND_EXECUTION]: The setup instructions include shell commands for setting environment variables (export SCAVIO_API_KEY) and curl examples for testing the API endpoints.

publix-api